Query: detection rule: Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.
Matching passage: Sigma rule: Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.. Logsource: windows / image_load. Rule: title: VMMap Signed Dbghelp.DLL Potential Sideloading id: 98ffaed4-aec2-4e04-9b07-31492fe68b3d related: - id: 273a8dd8-3742-4302-bcc7-7df5a80fe425 type: similar status: test description: Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap. references: - https://techcommunity.microsoft.com/t5/sysinternals-blog/zoomit-v7-1-procdump-2-0-for-linux-process-explorer-v17-05/ba-p/3884766 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-05 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|contains: C:\Debuggers\dbghelp.dll Image|endswith: - \vmmap.exe - \vmmap64.exe Signed: 'true' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svc. Logsource: windows / registry_set. Rule: title: Scheduled TaskCache Change by Uncommon Program id: 4720b7df-40c3-48fd-bbdf-fd4b3c464f0d status: test description: Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious references: - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://labs.f-secure.com/blog/scheduled-task-tampering/ author: Syed Hasan (@syedhasan009) date: 2021-06-18 modified: 2025-10-22 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053 - attack.t1053.005 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\ filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_other: TargetObject|contains: - Microsoft\Windows\UpdateOrchestrator - Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask\Index - Microsoft\Windows\Flighting\OneSettings\RefreshCache\Index filter_main_mousocoreworker: Image|endswith: C:\Windows\System32\MoUsoCoreWorker.exe filter_main_services: Image|endswith: C:\Windows\System32\services.exe filter_main_tiworker: Image|startswith: C:\Windows\ Image|endswith: \TiWorker.exe filter_main_svchost: Image: C:\WINDOWS\system32\svchost.exe filter_main_ngen: Image|startswith: C:\Windows\Microsoft.NET\Framework Image|endswith: \ngen.exe TargetObject|contains: - \Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B66B135D-DA06-4FC4-95F8-7458E1D10129} - \Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\.NET Framework\.NET Framework NGEN filter_main_office: Image: - C:\Program Files\Microsoft Office\root\Integration\Integrator.exe - C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe - C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe - C:\Program Files (x86)\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe filter_main_msiexec: Image: C:\Windows\System32\msiexec.exe filter_main_explorer: Image: C:\Windows\explorer.exe TargetObject|contains: \Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\PLA\Server Manager Performance Monitor\ filter_main_system: Image: System filter_main_runtimebroker: Image: C:\Windows\System32\RuntimeBroker.exe filter_optional_dropbox_updater: Image: - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe - C:\Program Files\Dropbox\Update