Windows Image Load: Unsigned dbghelp.dll/dbgcore.dll Loaded by Suspicious Process

Alerts on unsigned loading of dbghelp.dll/dbgcore.dll, often associated with memory dump creation and credential-access workflows.

FreeReviewedSigma · High · v2

Product: windows
Category: image_load
Author: Perez Diego (@darkquassar), oscd.community, Ecco (SigmaHQ), DRL 1.1
Published: 2019-10-27
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows processes that load dbghelp.dll or dbgcore.dll when the loaded DLL is unsigned. These libraries can be used to generate memory dumps via MiniDumpWriteDump, which attackers may use to access sensitive process memory such as credentials. It relies on image load telemetry (DLL path ending with dbghelp.dll/dbgcore.dll) and the signed status of the loaded module.

Reporting behind it

Related detections9 linkedT1003.001 — drag to rearrange

Malicious PowerDump Credential Extraction via PowerShell

Malicious LSASS Credential Dump via rundll32 comsvcs.dll (via process_creation)

Malicious LSASS Memory Dump via rundll32 comsvcs MiniDump in tasklist For-Loop (via process_creation)

Malicious Mimikatz Credential Dumping via Command Line Arguments

Malicious Credential Extraction via Volatility Memory Analysis (via process_creation)

Suspicious Physical Memory Acquisition via WinPmem (via process_creation)

Malicious LSASS Credential Dump via Rundll32 Comsvcs MiniDump via Process Creation (via process_creation)

Suspicious LSASS Credential Access via PowerShell (via process_creation)

Suspicious LSASS Memory Dump via Task Manager After Ivanti Exploitation

Windows Image Load: Unsigned dbghelp.dll/dbgcore.dll Loaded by Suspicious Process

Pivot detection · T1003.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-loads-unsigned-dbghelp-dll-or-dbgcore-dll-bdc64095

title: "Windows Image Load: Unsigned dbghelp.dll/dbgcore.dll Loaded by Suspicious Process"
id: f8894dff-6084-4c05-9080-b524186276ce
related:
  - id: 0e277796-5f23-4e49-a490-483131d4f6e1
    type: similar
  - id: bdc64095-d59a-42a2-8588-71fd9c9d9abc
    type: derived
status: test
description: This rule flags Windows processes that load dbghelp.dll or dbgcore.dll when the loaded DLL is unsigned. These libraries can be used to generate memory dumps via MiniDumpWriteDump, which attackers may use to access sensitive process memory such as credentials. It relies on image load telemetry (DLL path ending with dbghelp.dll/dbgcore.dll) and the signed status of the loaded module.
references:
  - https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
  - https://www.pinvoke.net/default.aspx/dbghelp/MiniDumpWriteDump.html
  - https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_dbghelp_dbgcore_unsigned_load.yml
author: Perez Diego (@darkquassar), oscd.community, Ecco, Huntrule Team
date: 2019-10-27
modified: 2022-12-09
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith:
      - \dbghelp.dll
      - \dbgcore.dll
    Signed: "false"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL