Windows: Suspicious DLL sideloading via dbghelp.dll image loads

Alerts on dbghelp.dll being loaded from non-standard locations, indicating possible DLL sideloading.

FreeUnreviewedSigmamediumv1

windows-suspicious-dll-sideloading-via-dbghelp-dll-image-loads-6414b5cd

title: "Windows: Suspicious DLL sideloading via dbghelp.dll image loads"
id: 0785d2cf-2cce-487d-873a-92fd09d7196a
status: test
description: This rule flags executions where an image load event includes a path ending with '\dbghelp.dll' while excluding common Windows and Program Files locations, plus several known software-specific exceptions. Attackers may sideload a malicious dbghelp.dll by placing it in a searched directory so the process loads attacker-controlled code. The detection relies on Windows image-load telemetry with file path matching for dbghelp.dll and specific allowlist filters.
references:
  - https://hijacklibs.net/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_dbghelp.yml
author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research), Huntrule Team
date: 2022-10-25
modified: 2025-10-07
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \dbghelp.dll
  filter_main_generic:
    ImageLoaded|startswith:
      - C:\Program Files (x86)\
      - C:\Program Files\
      - C:\Windows\SoftwareDistribution\
      - C:\Windows\System32\
      - C:\Windows\SystemTemp\
      - C:\Windows\SysWOW64\
      - C:\Windows\WinSxS\
  filter_optional_anaconda:
    ImageLoaded|endswith:
      - \Anaconda3\Lib\site-packages\vtrace\platforms\windll\amd64\dbghelp.dll
      - \Anaconda3\Lib\site-packages\vtrace\platforms\windll\i386\dbghelp.dll
  filter_optional_epicgames:
    ImageLoaded|endswith:
      - \Epic Games\Launcher\Engine\Binaries\ThirdParty\DbgHelp\dbghelp.dll
      - \Epic Games\MagicLegends\x86\dbghelp.dll
  filter_optional_opera:
    ImageLoaded|contains: opera\Opera Installer Temp\opera_package
    ImageLoaded|endswith: \assistant\dbghelp.dll
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Legitimate applications loading their own versions of the DLL mentioned in this rule
level: medium
license: DRL-1.1
related:
  - id: 6414b5cd-b19d-447e-bb5e-9f03940b5784
    type: derived

What it detects

This rule flags executions where an image load event includes a path ending with '\dbghelp.dll' while excluding common Windows and Program Files locations, plus several known software-specific exceptions. Attackers may sideload a malicious dbghelp.dll by placing it in a searched directory so the process loads attacker-controlled code. The detection relies on Windows image-load telemetry with file path matching for dbghelp.dll and specific allowlist filters.

Known false positives

Legitimate applications loading their own versions of the DLL mentioned in this rule

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.