title: Load of dbghelp/dbgcore DLL from Suspicious Process
id: 0e277796-5f23-4e49-a490-483131d4f6e1
status: experimental
description: Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump
    API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and
    transfer it over the network back to the attacker's machine.
date: 2019/10/27
modified: 2020/08/23
author: Perez Diego (@darkquassar), oscd.community, Ecco
references:
    - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
    - https://www.pinvoke.net/default.aspx/dbghelp/MiniDumpWriteDump.html
    - https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6
tags:
    - attack.credential_access
    - attack.t1003          # an old one
    - attack.t1003.001
logsource:
    category: image_load
    product: windows
detection:
    signedprocess:
        ImageLoaded|endswith:
            - '\dbghelp.dll'
            - '\dbgcore.dll'
        Image|endswith: 
            - '\msbuild.exe'
            - '\cmd.exe'
            - '\svchost.exe'
            - '\rundll32.exe'
            - '\powershell.exe'
            - '\word.exe'
            - '\excel.exe'
            - '\powerpnt.exe'
            - '\outlook.exe'
            - '\monitoringhost.exe'
            - '\wmic.exe'
              # - '\msiexec.exe'  an installer installing a program using one of those DLL will raise an alert
            - '\bash.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\regsvr32.exe'
            - '\schtasks.exe'
            - '\dnx.exe'
            - '\regsvcs.exe'
            - '\sc.exe'
            - '\scriptrunner.exe'
    unsignedprocess:
        ImageLoaded|endswith:
            - '\dbghelp.dll'
            - '\dbgcore.dll'
        Signed: "FALSE"
    filter:
        Image|contains: 'Visual Studio'
    condition: (signedprocess AND NOT filter) OR (unsignedprocess AND NOT filter)
fields:
    - ComputerName
    - User
    - Image
    - ImageLoaded
falsepositives:
    - Penetration tests
level: high
