Query: rule covering Detects potential DLL sideloading of "dbghelp.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "dbghelp.dll". Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of DBGHELP.DLL id: 6414b5cd-b19d-447e-bb5e-9f03940b5784 status: test description: Detects potential DLL sideloading of "dbghelp.dll" references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-10-25 modified: 2025-10-07 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \dbghelp.dll filter_main_generic: ImageLoaded|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemTemp\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_optional_anaconda: ImageLoaded|endswith: - \Anaconda3\Lib\site-packages\vtrace\platforms\windll\amd64\dbghelp.dll - \Anaconda3\Lib\site-packages\vtrace\platforms\windll\i386\dbghelp.dll filter_optional_epicgames: ImageLoaded|endswith: - \Epic Games\Launcher\Engine\Binaries\ThirdParty\DbgHelp\dbghelp.dll - \Epic Games\MagicLegends\x86\dbghelp.dll filter_optional_opera: ImageLoaded|contains: opera\Opera Installer Temp\opera_package ImageLoaded|endswith: \assistant\dbghelp.dll condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate applications loading their own versions of the DLL mentioned in this rule level: medium
Near-miss passage: Sigma rule: Detects attackers attempting to disable Windows Defender using Powershell. Logsource: windows / process_creation. Rule: title: Disable Windows Defender AV Security Monitoring id: a7ee1722-c3c5-aeff-3212-c777e4733217 status: test description: Detects attackers attempting to disable Windows Defender using Powershell references: - https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/ - https://rvsec0n.wordpress.com/2020/01/24/malwares-that-bypass-windows-defender/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md author: ok @securonix invrep-de, oscd.community, frack113 date: 2020-10-12 modified: 2022-11-18 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_pwsh_binary: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_pwsh_cli: CommandLine|contains: - -DisableBehaviorMonitoring $true - -DisableRuntimeMonitoring $true selection_sc_binary: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_sc_tamper_cmd_stop: CommandLine|contains|all: - stop - WinDefend selection_sc_tamper_cmd_delete: CommandLine|contains|all: - delete - WinDefend selection_sc_tamper_cmd_disabled: CommandLine|contains|all: - config - WinDefend - start=disabled condition: all of selection_pwsh_* or (selection_sc_binary and 1 of selection_sc_tamper_*) falsepositives: - Minimal, for some older versions of dev tools, such as pycharm, developers were known to sometimes disable Windows Defender to improve performance, but this generally is not considered a good security practice. level: high