Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process
Detects the loading of `dbghelp.dll` or `dbgcore.dll` by processes that are typically not expected to load these DLLs. These DLLs export functions like `MiniDumpWriteDump` which can be used to dump process memory, including sensitive information like credentials from processes such as LSASS. This behavior is often observed in attacker tradecraft, such as with the SilentTrinity C2 Framework, or by legitimate debugging tools like ProcessHacker. The rule includes filters for common legitimate Windows processes and services that might load these DLLs to reduce false positives. Investigation of the command line and image location of the process loading the DLL is recommended.
Sigma
