Potential DbgModel.DLL Sideloading

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects potential DLL sideloading of "DbgModel.dll" when it is loaded from a non-standard or unexpected directory. This rule specifically filters out legitimate loads from common Windows system directories and known application paths like WinDbg and Windows Kits.