Windows Process Access to LSASS with dbgcore.dll/dbghelp.dll in CallTrace

Alerts on suspicious LSASS access from unusual locations when dbgcore.dll or dbghelp.dll appears in the call trace.

FreeUnreviewedSigmahighv1

windows-process-access-to-lsass-with-dbgcore-dll-dbghelp-dll-in-calltrace-9f5c1d59

title: Windows Process Access to LSASS with dbgcore.dll/dbghelp.dll in CallTrace
id: d2010377-1d9a-401c-afa1-3ad051ed4d96
related:
  - id: 416bc4a2-7217-4519-8dc7-c3271817f1d5
    type: similar
  - id: 9f5c1d59-33be-4e60-bcab-85d2f566effd
    type: derived
status: experimental
description: This rule flags process access targeting lsass.exe where the access call trace contains dbgcore.dll and/or dbghelp.dll, and the source process runs from uncommon filesystem locations. Attackers may use these debugging-related libraries to support LSASS memory access and related credential dumping workflows. The detection relies on Windows process access events that include the target image, source image path, and a call trace containing the specified DLL names.
references:
  - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html
  - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpwritedump
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-27
tags:
  - attack.credential-access
  - attack.defense-impairment
  - attack.t1003.001
  - attack.t1685
logsource:
  category: process_access
  product: windows
detection:
  selection_lsass_calltrace:
    TargetImage|endswith: \lsass.exe
    CallTrace|contains:
      - dbgcore.dll
      - dbghelp.dll
  selection_susp_location:
    SourceImage|contains:
      - :\Perflogs\
      - :\Temp\
      - :\Users\Public\
      - \$Recycle.Bin\
      - \AppData\Roaming\
      - \Contacts\
      - \Desktop\
      - \Documents\
      - \Downloads\
      - \Favorites\
      - \Favourites\
      - \inetpub\wwwroot\
      - \Music\
      - \Pictures\
      - \Start Menu\Programs\Startup\
      - \Users\Default\
      - \Videos\
      - \Windows\Temp\
  condition: all of selection_*
falsepositives:
  - Possibly during software installation or update processes
level: high
regression_tests_path: regression_data/rules/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load/info.yml
license: DRL-1.1

What it detects

This rule flags process access targeting lsass.exe where the access call trace contains dbgcore.dll and/or dbghelp.dll, and the source process runs from uncommon filesystem locations. Attackers may use these debugging-related libraries to support LSASS memory access and related credential dumping workflows. The detection relies on Windows process access events that include the target image, source image path, and a call trace containing the specified DLL names.

Known false positives

Possibly during software installation or update processes

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.