Windows Image Load: Unsigned dbghelp.dll/dbgcore.dll Loaded by Suspicious Process
Alerts on unsigned loading of dbghelp.dll/dbgcore.dll, often associated with memory dump creation and credential-access workflows.
- Product
- windows
- Category
- image_load
- Author
- Perez Diego (@darkquassar), oscd.community, Ecco (SigmaHQ), DRL 1.1
- Published
- 2019-10-27
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows processes that load dbghelp.dll or dbgcore.dll when the loaded DLL is unsigned. These libraries can be used to generate memory dumps via MiniDumpWriteDump, which attackers may use to access sensitive process memory such as credentials. It relies on image load telemetry (DLL path ending with dbghelp.dll/dbgcore.dll) and the signed status of the loaded module.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
- pinvoke.nethttps://www.pinvoke.net/default.aspx/dbghelp/MiniDumpWriteDump.html
- medium.comhttps://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_dbghelp_dbgcore_unsigned_load.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Image Load: Unsigned dbghelp.dll/dbgcore.dll Loaded by Suspicious Process"
id: f8894dff-6084-4c05-9080-b524186276ce
related:
- id: 0e277796-5f23-4e49-a490-483131d4f6e1
type: similar
- id: bdc64095-d59a-42a2-8588-71fd9c9d9abc
type: derived
status: test
description: This rule flags Windows processes that load dbghelp.dll or dbgcore.dll when the loaded DLL is unsigned. These libraries can be used to generate memory dumps via MiniDumpWriteDump, which attackers may use to access sensitive process memory such as credentials. It relies on image load telemetry (DLL path ending with dbghelp.dll/dbgcore.dll) and the signed status of the loaded module.
references:
- https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
- https://www.pinvoke.net/default.aspx/dbghelp/MiniDumpWriteDump.html
- https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_dbghelp_dbgcore_unsigned_load.yml
author: Perez Diego (@darkquassar), oscd.community, Ecco, Huntrule Team
date: 2019-10-27
modified: 2022-12-09
tags:
- attack.credential-access
- attack.t1003.001
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith:
- \dbghelp.dll
- \dbgcore.dll
Signed: "false"
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1