WerFaultSecure.exe Loading dbgcore.dll or dbghelp.dll (Windows image load)

title: WerFaultSecure.exe Loading dbgcore.dll or dbghelp.dll (Windows image load)
id: c05327cf-bbce-4a55-bf48-3a49c207b1c4
related:
  - id: 387df17d-3b04-448f-8669-9e7fd5e5fd8c
    type: similar
  - id: 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2
    type: similar
  - id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b
    type: derived
status: experimental
description: This rule flags Windows processes where WerFaultSecure.exe loads dbgcore.dll or dbghelp.dll. Attackers may leverage this behavior as part of defense-impairment tactics to disrupt or evade security monitoring. The detection relies on image load telemetry that records the loaded DLL path and the loading process executable, and it should be investigated alongside other concurrent process activity, network connections, and file changes. Be aware that similar DLL loads can also occur during legitimate software installations, so confirm suspicious context around the DLL load timing.
references:
  - https://github.com/TwoSevenOneT/EDR-Freeze
  - https://blog.axelarator.net/hunting-for-edr-freeze/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/image_load/image_load_win_werfaultsecure_dbgcore_dbghelp_load.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-27
modified: 2026-01-09
tags:
  - attack.defense-impairment
  - attack.t1685
  - detection.threat-hunting
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \WerFaultSecure.exe
    ImageLoaded|endswith:
      - \dbgcore.dll
      - \dbghelp.dll
  condition: selection
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules-threat-hunting/windows/image_load/image_load_win_werfaultsecure_dbgcore_dbghelp_load/info.yml
license: DRL-1.1