Windows Process Loads Unsigned dbghelp.dll or dbgcore.dll

title: Windows Process Loads Unsigned dbghelp.dll or dbgcore.dll
id: f8894dff-6084-4c05-9080-b524186276ce
related:
  - id: 0e277796-5f23-4e49-a490-483131d4f6e1
    type: similar
  - id: bdc64095-d59a-42a2-8588-71fd9c9d9abc
    type: derived
status: test
description: This rule flags Windows image loads where a process loads dbghelp.dll or dbgcore.dll while the loaded module is not signed. These DLLs are commonly used to generate memory dumps, and unsigned loads from unexpected processes can indicate an attempt to collect sensitive process contents. The detection relies on process/module load telemetry that records the loaded image path and whether the module is signed.
references:
  - https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
  - https://www.pinvoke.net/default.aspx/dbghelp/MiniDumpWriteDump.html
  - https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_dbghelp_dbgcore_unsigned_load.yml
author: Perez Diego (@darkquassar), oscd.community, Ecco, Huntrule Team
date: 2019-10-27
modified: 2022-12-09
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith:
      - \dbghelp.dll
      - \dbgcore.dll
    Signed: "false"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1