Potential DLL Sideloading Of DBGHELP.DLL
Detects potential DLL sideloading of "dbghelp.dll"
Sigma rule (View on GitHub)
1title: Potential DLL Sideloading Of DBGHELP.DLL
2id: 6414b5cd-b19d-447e-bb5e-9f03940b5784
3status: test
4description: Detects potential DLL sideloading of "dbghelp.dll"
5references:
6 - https://hijacklibs.net/ # For list of DLLs that could be sideloaded (search for dlls mentioned here in there)
7author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
8date: 2022-10-25
9modified: 2025-10-07
10tags:
11 - attack.defense-evasion
12 - attack.persistence
13 - attack.privilege-escalation
14 - attack.t1574.001
15logsource:
16 category: image_load
17 product: windows
18detection:
19 selection:
20 ImageLoaded|endswith: '\dbghelp.dll'
21 filter_main_generic:
22 ImageLoaded|startswith:
23 - 'C:\Program Files (x86)\'
24 - 'C:\Program Files\'
25 - 'C:\Windows\SoftwareDistribution\'
26 - 'C:\Windows\System32\'
27 - 'C:\Windows\SystemTemp\'
28 - 'C:\Windows\SysWOW64\'
29 - 'C:\Windows\WinSxS\'
30 filter_optional_anaconda:
31 ImageLoaded|endswith:
32 - '\Anaconda3\Lib\site-packages\vtrace\platforms\windll\amd64\dbghelp.dll'
33 - '\Anaconda3\Lib\site-packages\vtrace\platforms\windll\i386\dbghelp.dll'
34 filter_optional_epicgames:
35 ImageLoaded|endswith:
36 - '\Epic Games\Launcher\Engine\Binaries\ThirdParty\DbgHelp\dbghelp.dll'
37 - '\Epic Games\MagicLegends\x86\dbghelp.dll'
38 filter_optional_opera:
39 ImageLoaded|contains: 'opera\Opera Installer Temp\opera_package'
40 ImageLoaded|endswith: '\assistant\dbghelp.dll'
41 condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
42falsepositives:
43 - Legitimate applications loading their own versions of the DLL mentioned in this rule
44level: medium
References
Related rules
- Potential Antivirus Software DLL Sideloading
- Potential DLL Sideloading Of DBGCORE.DLL
- Potential JLI.dll Side-Loading
- Potential System DLL Sideloading From Non System Locations
- Creation Of Non-Existent System DLL