Windows Image Load: dbgcore.dll/dbghelp.dll Loaded from Uncommon User and System Paths
Alerts when dbgcore.dll or dbghelp.dll is loaded from user or other uncommon directories on Windows.
- Product
- windows
- Category
- image_load
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-11-27
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows processes that load dbgcore.dll or dbghelp.dll when the loaded image path ends with those DLL names and the DLL is located in uncommon directories (for example, user, startup, recycle bin, and web root paths). Attackers may abuse these libraries because they can provide debugging and dump-related capabilities used to collect sensitive information or impair defensive tooling. The detection relies on image load telemetry, specifically the loaded module path and its directory components.
Reporting behind it
- blog.axelarator.nethttps://blog.axelarator.net/hunting-for-edr-freeze/
- zerosalarium.comhttps://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html
- splunk.comhttps://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Image Load: dbgcore.dll/dbghelp.dll Loaded from Uncommon User and System Paths"
id: 72a6ab9d-6821-4dc9-94fd-e21009529bfb
related:
- id: 9f5c1d59-33be-4e60-bcab-85d2f566effd
type: similar
- id: 416bc4a2-7217-4519-8dc7-c3271817f1d5
type: derived
status: experimental
description: This rule flags Windows processes that load dbgcore.dll or dbghelp.dll when the loaded image path ends with those DLL names and the DLL is located in uncommon directories (for example, user, startup, recycle bin, and web root paths). Attackers may abuse these libraries because they can provide debugging and dump-related capabilities used to collect sensitive information or impair defensive tooling. The detection relies on image load telemetry, specifically the loaded module path and its directory components.
references:
- https://blog.axelarator.net/hunting-for-edr-freeze/
- https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html
- https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-27
modified: 2026-01-09
tags:
- attack.credential-access
- attack.defense-impairment
- attack.t1003
- attack.t1685
logsource:
category: image_load
product: windows
detection:
selection_img:
Image|contains:
- :\Perflogs\
- :\Temp\
- :\Users\Public\
- \$Recycle.Bin\
- \Contacts\
- \Documents\
- \Favorites\
- \Favourites\
- \inetpub\wwwroot\
- \Music\
- \Pictures\
- \Start Menu\Programs\Startup\
- \Users\Default\
- \Videos\
selection_dll:
ImageLoaded|endswith:
- \dbgcore.dll
- \dbghelp.dll
condition: all of selection_*
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load/info.yml
license: DRL-1.1