Windows DLL Sideloading: dbgcore.dll loaded from unusual paths

title: "Windows DLL Sideloading: dbgcore.dll loaded from unusual paths"
id: bd1fe3bc-1a9b-4844-8128-efe0ebb279ee
status: test
description: This rule flags Windows processes that load dbgcore.dll via image load events when the DLL path ends with \dbgcore.dll and is not one of several common, expected system or installer locations. Attackers can abuse DLL search order and sideloading to execute malicious code under a legitimate process context. The detection relies on telemetry that records ImageLoaded paths for loaded DLLs on Windows.
references:
  - https://hijacklibs.net/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_dbgcore.yml
author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research), Huntrule Team
date: 2022-10-25
modified: 2025-10-06
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \dbgcore.dll
  filter_main_generic:
    ImageLoaded|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
      - C:\Windows\SoftwareDistribution\
      - C:\Windows\System32\
      - C:\Windows\SystemTemp\
      - C:\Windows\SysWOW64\
      - C:\Windows\WinSxS\
  filter_optional_steam:
    ImageLoaded|endswith: \Steam\bin\cef\cef.win7x64\dbgcore.dll
  filter_optional_opera:
    ImageLoaded|contains: opera\Opera Installer Temp\opera_package
    ImageLoaded|endswith: \assistant\dbgcore.dll
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate applications loading their own versions of the DLL mentioned in this rule
level: medium
license: DRL-1.1
related:
  - id: 9ca2bf31-0570-44d8-a543-534c47c33ed7
    type: derived