Potential DLL Sideloading: Image Load of DbgModel.dll on Windows

Alerts when a process loads DbgModel.dll from a non-standard path, suggesting possible DLL sideloading.

FreeReviewedSigma · Medium · v2

Product: windows
Category: image_load
Author: Gary Lobermier (SigmaHQ), DRL 1.1
Published: 2024-07-11
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1574.001DLL
Persistence
- T1574.001DLL
Priv Esc
- T1574.001DLL
Defense Evasion
- T1574.001DLL
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process image-load events where a loaded module path ends with dbgmodel.dll but does not originate from common Windows system directories or known optional installation locations. DLL sideloading matters because attackers can place a malicious DLL in a location that a trusted application loads, leading to code execution. The detection relies on Windows image_load telemetry that records the ImageLoaded path for loaded modules.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange

Suspicious msimg32.dll Loaded from Non-System Directory

DLL Side-Loading via Signed Binary Loading Known Malicious Helper DLL

Suspicious DLL Sideloading via msdtc oci.dll Install (via process_creation)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Suspicious LucidRook DismCore.dll Side-Load into Browser Process

Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)

Suspicious RoboForm Signed Binary Executed From Non-Standard Path (via process_creation)

Malicious dal_keepalives.dll Sideloaded By Signed Binary (via image_load)

Suspicious Cortex XDR Binary Sideloading winutils.dll (via image_load)

Potential DLL Sideloading: Image Load of DbgModel.dll on Windows

Pivot detection · T1574.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-dll-sideloading-suspicion-via-image-load-of-dbgmodel-dll-fef394cd

title: "Potential DLL Sideloading: Image Load of DbgModel.dll on Windows"
id: 35f3641c-cf76-4cc5-9750-7ca8aec98051
status: test
description: This rule flags process image-load events where a loaded module path ends with dbgmodel.dll but does not originate from common Windows system directories or known optional installation locations. DLL sideloading matters because attackers can place a malicious DLL in a location that a trusted application loads, leading to code execution. The detection relies on Windows image_load telemetry that records the ImageLoaded path for loaded modules.
references:
  - https://hijacklibs.net/entries/microsoft/built-in/dbgmodel.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_dbgmodel.yml
author: Gary Lobermier, Huntrule Team
date: 2024-07-11
modified: 2024-07-22
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  product: windows
  category: image_load
detection:
  selection:
    ImageLoaded|endswith: \dbgmodel.dll
  filter_main_generic:
    ImageLoaded|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C:\Windows\WinSxS\
  filter_optional_windbg:
    ImageLoaded|startswith: C:\Program Files\WindowsApps\Microsoft.WinDbg_
  filter_optional_windows_kits:
    ImageLoaded|startswith:
      - C:\Program Files (x86)\Windows Kits\
      - C:\Program Files\Windows Kits\
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate applications loading their own versions of the DLL mentioned in this rule
level: medium
license: DRL-1.1
related:
  - id: fef394cd-f44d-4040-9b18-95d92fe278c0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL