Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded

Status: test
Severity: high
Log source: category image_load, product windows
Author: Perez Diego (@darkquassar), oscd.community, Ecco
Source: github.com/SigmaHQ/sigma

Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1003.001` OS Credential Dumping: LSASS Memory

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 7: Image loaded

Rule body

title: Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded
id: bdc64095-d59a-42a2-8588-71fd9c9d9abc
related:
    - id: 0e277796-5f23-4e49-a490-483131d4f6e1 # Suspicious Loading
      type: similar
status: test
description: |
    Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes.
    Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll.
    As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.
references:
    - https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
    - https://www.pinvoke.net/default.aspx/dbghelp/MiniDumpWriteDump.html
    - https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6
author: Perez Diego (@darkquassar), oscd.community, Ecco
date: 2019-10-27
modified: 2022-12-09
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith:
            - '\dbghelp.dll'
            - '\dbgcore.dll'
        Signed: 'false'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    ImageLoaded|endswith:
        - '\dbghelp.dll'
        - '\dbgcore.dll'
    Signed: 'false'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ImageLoaded`	ends_with	`\dbgcore.dll` corpus 6 (sigma 6) `\dbghelp.dll` corpus 6 (sigma 6)	`field:"ImageLoaded" kind:ends_with`
`Signed`	eq	`false` corpus 9 (splunk 5, sigma 4)	`field:"Signed" kind:eq value:"false"`