title: Load of dbghelp/dbgcore DLL from Suspicious Process
id: 0e277796-5f23-4e49-a490-483131d4f6e1
status: test
description: Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.
author: Perez Diego (@darkquassar), oscd.community, Ecco
references:
  - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
  - https://www.pinvoke.net/default.aspx/dbghelp/MiniDumpWriteDump.html
  - https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6
date: 2019/10/27
modified: 2022/02/21
logsource:
  category: image_load
  product: windows
detection:
  signedprocess:
    ImageLoaded|endswith:
      - '\dbghelp.dll'
      - '\dbgcore.dll'
    Image|endswith:
      - '\msbuild.exe'
      - '\cmd.exe'
      # - '\svchost.exe'  triggered by installing common software
      - '\rundll32.exe'
      # - '\powershell.exe'  triggered by installing common software
      - '\word.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\monitoringhost.exe'
      - '\wmic.exe'
      # - '\msiexec.exe'  an installer installing a program using one of those DLL will raise an alert
      - '\bash.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      # - '\regsvr32.exe'  triggered by installing common software
      - '\schtasks.exe'
      - '\dnx.exe'
      - '\regsvcs.exe'
      - '\sc.exe'
      - '\scriptrunner.exe'
  unsignedprocess:
    ImageLoaded|endswith:
      - '\dbghelp.dll'
      - '\dbgcore.dll'
    Signed: 'FALSE'
  filter1:
    - Image|contains: 'Visual Studio'
    - CommandLine|contains:
      - '-k LocalSystemNetworkRestricted'
      - '-k UnistackSvcGroup -s WpnUserService'
  filter2:   # Not available in Sysmon, but in Aurora
    CommandLine:
      - 'C:\WINDOWS\winsxs\*\TiWorker.exe -Embedding'
      - 'C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv'
      - 'C:\Windows\System32\svchost.exe -k WerSvcGroup'
  condition: (signedprocess or unsignedprocess) and not filter1 and not filter2
fields:
  - ComputerName
  - User
  - Image
  - ImageLoaded
falsepositives:
  - Unknown
level: high
tags:
  - attack.credential_access
  - attack.t1003.001
