Windows DLL sideloading suspicion via image load of DbgModel.dll

Alerts when a process loads DbgModel.dll from a non-standard path, suggesting possible DLL sideloading.

FreeUnreviewedSigmamediumv1

windows-dll-sideloading-suspicion-via-image-load-of-dbgmodel-dll-fef394cd

title: Windows DLL sideloading suspicion via image load of DbgModel.dll
id: 35f3641c-cf76-4cc5-9750-7ca8aec98051
status: test
description: This rule flags Windows processes that load an image ending with \dbgmodel.dll while the load path is not within common, known system locations (System32, SysWOW64, WinSxS) or optional vendor directories (WindowsApps WinDbg, Windows Kits). Loading a DLL from an unexpected location can indicate DLL sideloading, a technique attackers use to execute malicious code under the context of a legitimate process. The rule relies on process image load telemetry that records the full ImageLoaded path for each loaded module.
references:
  - https://hijacklibs.net/entries/microsoft/built-in/dbgmodel.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_dbgmodel.yml
author: Gary Lobermier, Huntrule Team
date: 2024-07-11
modified: 2024-07-22
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  product: windows
  category: image_load
detection:
  selection:
    ImageLoaded|endswith: \dbgmodel.dll
  filter_main_generic:
    ImageLoaded|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C:\Windows\WinSxS\
  filter_optional_windbg:
    ImageLoaded|startswith: C:\Program Files\WindowsApps\Microsoft.WinDbg_
  filter_optional_windows_kits:
    ImageLoaded|startswith:
      - C:\Program Files (x86)\Windows Kits\
      - C:\Program Files\Windows Kits\
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate applications loading their own versions of the DLL mentioned in this rule
level: medium
license: DRL-1.1
related:
  - id: fef394cd-f44d-4040-9b18-95d92fe278c0
    type: derived

What it detects

This rule flags Windows processes that load an image ending with \dbgmodel.dll while the load path is not within common, known system locations (System32, SysWOW64, WinSxS) or optional vendor directories (WindowsApps WinDbg, Windows Kits). Loading a DLL from an unexpected location can indicate DLL sideloading, a technique attackers use to execute malicious code under the context of a legitimate process. The rule relies on process image load telemetry that records the full ImageLoaded path for each loaded module.

Known false positives

Legitimate applications loading their own versions of the DLL mentioned in this rule

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.