Windows DLL Image Load: dbgcore.dll/dbghelp.dll from User or Public Paths

title: "Windows DLL Image Load: dbgcore.dll/dbghelp.dll from User or Public Paths"
id: 72a6ab9d-6821-4dc9-94fd-e21009529bfb
related:
  - id: 9f5c1d59-33be-4e60-bcab-85d2f566effd
    type: similar
  - id: 416bc4a2-7217-4519-8dc7-c3271817f1d5
    type: derived
status: experimental
description: This rule flags Windows processes loading dbgcore.dll or dbghelp.dll when the loaded Image path ends in these DLL names and the DLL is sourced from uncommon directories such as user folders, public locations, or common non-system paths. Attackers may use these components to enable dump-related activity or to hinder security tooling. The detection relies on Windows image load telemetry (ImageLoaded) and the originating Image path string.
references:
  - https://blog.axelarator.net/hunting-for-edr-freeze/
  - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html
  - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-27
modified: 2026-01-09
tags:
  - attack.credential-access
  - attack.defense-impairment
  - attack.t1003
  - attack.t1685
logsource:
  category: image_load
  product: windows
detection:
  selection_img:
    Image|contains:
      - :\Perflogs\
      - :\Temp\
      - :\Users\Public\
      - \$Recycle.Bin\
      - \Contacts\
      - \Documents\
      - \Favorites\
      - \Favourites\
      - \inetpub\wwwroot\
      - \Music\
      - \Pictures\
      - \Start Menu\Programs\Startup\
      - \Users\Default\
      - \Videos\
  selection_dll:
    ImageLoaded|endswith:
      - \dbgcore.dll
      - \dbghelp.dll
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load/info.yml
license: DRL-1.1