Query: alert when Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories. These DLLs contain the M
Matching passage: Sigma rule: Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories. These DLLs contain the M. Logsource: windows / image_load. Rule: title: Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location id: 416bc4a2-7217-4519-8dc7-c3271817f1d5 related: - id: 9f5c1d59-33be-4e60-bcab-85d2f566effd type: similar status: experimental description: 'Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories. These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes. ' references: - https://blog.axelarator.net/hunting-for-edr-freeze/ - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-27 modified: 2026-01-09 tags: - attack.credential-access - attack.defense-impairment - attack.t1003 - attack.t1685 logsource: category: image_load product: windows detection: selection_img: Image|contains: - :\Perflogs\ - :\Temp\ - :\Users\Public\ - \$Recycle.Bin\ - \Contacts\ - \Documents\ - \Favorites\ - \Favourites\ - \inetpub\wwwroot\ - \Music\ - \Pictures\ - \Start Menu\Programs\Startup\ - \Users\Default\ - \Videos\ selection_dll: ImageLoaded|endswith: - \dbgcore.dll - \dbghelp.dll condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load/info.yml
Near-miss passage: Sigma rule: Identifies when a Azure Kubernetes network policy is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Network Policy Change id: 08d6ac24-c927-4469-b3b7-2e422d6e3c43 status: test description: Identifies when a Azure Kubernetes network policy is modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.credential-access - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/NETWORKING.K8S.IO/NETWORKPOLICIES/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/NETWORKING.K8S.IO/NETWORKPOLICIES/DELETE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EXTENSIONS/NETWORKPOLICIES/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EXTENSIONS/NETWORKPOLICIES/DELETE condition: selection falsepositives: - Network Policy being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Network Policy being modified and deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium