deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Suspicious File Download From File Sharing Websites -  File Stream
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-08-24
ATT&CK techniques: T1564.004
Log source: windows/create_stream_hash

Description:
Detects the download of suspicious file type from a well-known file and paste sharing domain

Detection logic:
{
  "selection_domain": {
    "Contents|contains": [
      ".githubusercontent.com",
      "anonfiles.com",
      "cdn.discordapp.com",
      "ddns.net",
      "dl.dropboxusercontent.com",
      "ghostbin.co",
      "github.com",
      "glitch.me",
      "gofile.io",
      "hastebin.com",
      "mediafire.com",
      "mega.nz",
      "onrender.com",
      "pages.dev",
      "paste.ee",
      "pastebin.com",
      "pastebin.pl",
      "pastetext.net",
      "pixeldrain.com",
      "privatlab.com",
      "privatlab.net",
      "send.exploit.in",
      "sendspace.com",
      "storage.googleapis.com",
      "storjshare.io",
      "supabase.co",
      "temp.sh",
      "transfer.sh",
      "trycloudflare.com",
      "ufile.io",
      "w3spaces.com",
      "workers.dev"
    ]
  },
  "selection_extension": {
    "TargetFilename|contains": [
      ".cpl:Zone",
      ".dll:Zone",
      ".exe:Zone",
      ".hta:Zone",
      ".lnk:Zone",
      ".one:Zone",
      ".vbe:Zone",
      ".vbs:Zone",
      ".xll:Zone"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90015
  - https://www.cisa.gov/uscert/ncas/alerts/aa22-321a
  - https://fabian-voith.de/2020/06/25/sysmon-v11-1-reads-alternate-data-streams/
  - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
Sigma Detection Rule: Exports Registry Key To an Alternate Data Stream
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Oddvar Moe, Sander Wiebing, oscd.community
Date: 2020-10-07
ATT&CK techniques: T1564.004
Log source: windows/create_stream_hash

Description:
Exports the target Registry key and hides it in the specified alternate data stream.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\regedit.exe"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Regedit/
  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
Sigma Detection Rule: Creation Of a Suspicious ADS File Outside a Browser Download
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-10-22
Log source: windows/create_stream_hash

Description:
Detects the creation of a suspicious ADS (Alternate Data Stream) file by software other than browsers

Detection logic:
{
  "selection": {
    "Contents|startswith": "[ZoneTransfer]  ZoneId=3",
    "TargetFilename|endswith": ":Zone.Identifier",
    "TargetFilename|contains": [
      ".exe",
      ".scr",
      ".bat",
      ".cmd",
      ".docx",
      ".hta",
      ".jse",
      ".lnk",
      ".pptx",
      ".ps",
      ".reg",
      ".sct",
      ".vb",
      ".wsc",
      ".wsf",
      ".xlsx"
    ]
  },
  "filter_optional_brave": {
    "Image|endswith": "\\brave.exe"
  },
  "filter_optional_chrome": {
    "Image": [
      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
      "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe"
    ]
  },
  "filter_optional_firefox": {
    "Image": [
      "C:\\Program Files\\Mozilla Firefox\\firefox.exe",
      "C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe"
    ]
  },
  "filter_optional_ie": {
    "Image": [
      "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "C:\\Program Files\\Internet Explorer\\iexplore.exe"
    ]
  },
  "filter_optional_maxthon": {
    "Image|endswith": "\\maxthon.exe"
  },
  "filter_optional_edge_1": [
    {
      "Image|startswith": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\"
    },
    {
      "Image|endswith": "\\WindowsApps\\MicrosoftEdge.exe"
    },
    {
      "Image": [
        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
        "C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe"
      ]
    }
  ],
  "filter_optional

References:
  - https://www.bleepingcomputer.com/news/security/exploited-windows-zero-day-lets-javascript-files-bypass-security-warnings/
Sigma Detection Rule: Potentially Suspicious File Download From ZIP TLD
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2023-05-18
Log source: windows/create_stream_hash

Description:
Detects the download of a file with a potentially suspicious extension from a .zip top level domain.

Detection logic:
{
  "selection": {
    "Contents|contains": ".zip/",
    "TargetFilename|contains": [
      ".bat:Zone",
      ".dat:Zone",
      ".dll:Zone",
      ".doc:Zone",
      ".docm:Zone",
      ".exe:Zone",
      ".hta:Zone",
      ".pptm:Zone",
      ".ps1:Zone",
      ".rar:Zone",
      ".rtf:Zone",
      ".sct:Zone",
      ".vbe:Zone",
      ".vbs:Zone",
      ".ws:Zone",
      ".wsf:Zone",
      ".xll:Zone",
      ".xls:Zone",
      ".xlsm:Zone",
      ".zip:Zone"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/cyb3rops/status/[PII_REDACTED]95287297
  - https://fabian-voith.de/2020/06/25/sysmon-v11-1-reads-alternate-data-streams/
Sigma Detection Rule: UAC Bypass Using Iscsicpl - ImageLoad
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-17
ATT&CK techniques: T1548.002
Log source: windows/image_load

Description:
Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH%

Detection logic:
{
  "selection": {
    "Image": "C:\\Windows\\SysWOW64\\iscsicpl.exe",
    "ImageLoaded|endswith": "\\iscsiexe.dll"
  },
  "filter": {
    "ImageLoaded|contains|all": [
      "C:\\Windows\\",
      "iscsiexe.dll"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC
  - https://twitter.com/wdormann/status/[PII_REDACTED]10607110
Sigma Detection Rule: VMMap Unsigned Dbghelp.DLL Potential Sideloading
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-28
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.

Detection logic:
{
  "selection": {
    "ImageLoaded|contains": "C:\\Debuggers\\dbghelp.dll",
    "Image|endswith": [
      "\\vmmap.exe",
      "\\vmmap64.exe"
    ]
  },
  "filter_main_signed": {
    "Signed": "true"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://techcommunity.microsoft.com/t5/sysinternals-blog/zoomit-v7-1-procdump-2-0-for-linux-process-explorer-v17-05/ba-p/3884766
Sigma Detection Rule: GAC DLL Loaded Via Office Applications
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Antonlovesdnb
Date: 2020-02-19
ATT&CK techniques: T1204.002
Log source: windows/image_load

Description:
Detects any GAC DLL being loaded by an Office Product

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\excel.exe",
      "\\mspub.exe",
      "\\onenote.exe",
      "\\onenoteim.exe",
      "\\outlook.exe",
      "\\powerpnt.exe",
      "\\winword.exe"
    ],
    "ImageLoaded|startswith": "C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL"
  },
  "condition": "selection"
}

References:
  - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
Sigma Detection Rule: Microsoft VBA For Outlook Addin Loaded Via Outlook
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-08
ATT&CK techniques: T1204.002
Log source: windows/image_load

Description:
Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process

Detection logic:
{
  "selection": {
    "Image|endswith": "\\outlook.exe",
    "ImageLoaded|endswith": "\\outlvba.dll"
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=58
Sigma Detection Rule: Potential JLI.dll Side-Loading
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-07-25
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL side-loading of jli.dll.
JLI.dll has been observed being side-loaded by Java processes by various threat actors, including APT41, XWorm,
and others in order to load malicious payloads in context of legitimate Java processes.


Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\jli.dll"
  },
  "filter_main_legitimate_install_paths": {
    "ImageLoaded|startswith": [
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\"
    ],
    "Description": "OpenJDK Platform binary",
    "OriginalFileName": "jli.dll",
    "Product|startswith": "OpenJDK Platform",
    "Signed": "true"
  },
  "filter_optional_eclipse": {
    "ImageLoaded|startswith": "C:\\eclipse\\plugins\\"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://securelist.com/apt41-in-africa/116986/
  - https://lab52.io/blog/snake-keylogger-in-geopolitical-affairs-abuse-of-trusted-java-utilities-in-cybercrime-operations/
  - https://hijacklibs.net/entries/3rd_party/oracle/jli.html
  - https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting
Sigma Detection Rule: Microsoft Excel Add-In Loaded From Uncommon Location
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-12
ATT&CK techniques: T1204.002
Log source: windows/image_load

Description:
Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location

Detection logic:
{
  "selection": {
    "Image|endswith": "\\excel.exe",
    "ImageLoaded|contains": [
      "\\Desktop\\",
      "\\Downloads\\",
      "\\Perflogs\\",
      "\\Temp\\",
      "\\Users\\Public\\",
      "\\Windows\\Tasks\\"
    ],
    "ImageLoaded|endswith": ".xll"
  },
  "condition": "selection"
}

References:
  - https://www.mandiant.com/resources/blog/lnk-between-browsers
  - https://wazuh.com/blog/detecting-xll-files-used-for-dropping-fin7-jssloader-with-wazuh/
Sigma Detection Rule: Suspicious Unsigned Thor Scanner Execution
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-10-29
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects loading and execution of an unsigned thor scanner binary.

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\thor.exe",
      "\\thor64.exe"
    ],
    "ImageLoaded|endswith": [
      "\\thor.exe",
      "\\thor64.exe"
    ]
  },
  "filter_main": {
    "Signed": "true",
    "SignatureStatus": "valid",
    "Signature": "Nextron Systems GmbH"
  },
  "condition": "selection and not filter_main"
}

References:
  - Internal Research
Sigma Detection Rule: Amsi.DLL Loaded Via LOLBIN Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-01
Log source: windows/image_load

Description:
Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\amsi.dll",
    "Image|endswith": [
      "\\ExtExport.exe",
      "\\odbcconf.exe",
      "\\rundll32.exe"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
  - https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/
Sigma Detection Rule: Potential CCleanerReactivator.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior
Date: 2023-07-13
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "CCleanerReactivator.dll"

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\CCleanerReactivator.dll"
  },
  "filter_main_path": {
    "Image|startswith": [
      "C:\\Program Files\\CCleaner\\",
      "C:\\Program Files (x86)\\CCleaner\\"
    ],
    "Image|endswith": "\\CCleanerReactivator.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://lab52.io/blog/2344-2/
Sigma Detection Rule: Unsigned Image Loaded Into LSASS Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Teymur Kheirkhabarov, oscd.community
Date: 2019-10-22
ATT&CK techniques: T1003.001
Log source: windows/image_load

Description:
Loading unsigned image (DLL, EXE) into LSASS process

Detection logic:
{
  "selection": {
    "Image|endswith": "\\lsass.exe",
    "Signed": "false"
  },
  "condition": "selection"
}

References:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
Sigma Detection Rule: Potential CCleanerDU.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-07-13
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "CCleanerDU.dll"

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\CCleanerDU.dll"
  },
  "filter_main_path": {
    "Image|startswith": [
      "C:\\Program Files\\CCleaner\\",
      "C:\\Program Files (x86)\\CCleaner\\"
    ],
    "Image|endswith": [
      "\\CCleaner.exe",
      "\\CCleaner64.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://lab52.io/blog/2344-2/
Sigma Detection Rule: UAC Bypass With Fake DLL
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: oscd.community, Dmitry Uchakin
Date: 2020-10-06
ATT&CK techniques: T1548.002, T1574.001
Log source: windows/image_load

Description:
Attempts to load dismcore.dll after dropping it

Detection logic:
{
  "selection": {
    "Image|endswith": "\\dism.exe",
    "ImageLoaded|endswith": "\\dismcore.dll"
  },
  "filter": {
    "ImageLoaded": "C:\\Windows\\System32\\Dism\\dismcore.dll"
  },
  "condition": "selection and not filter"
}

References:
  - https://steemit.com/utopian-io/@ah101/uac-bypassing-utility
Sigma Detection Rule: BaaUpdate.exe Suspicious DLL Load
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-10-18
ATT&CK techniques: T1218, T1021.003
Log source: windows/image_load

Description:
Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly writable which could indicate an attempt to lateral movement via BitLocker DCOM & COM Hijacking.
This technique abuses COM Classes configured as INTERACTIVE USER to spawn processes in the context of the logged-on user's session. Specifically, it targets the BDEUILauncher Class (CLSID ab93b6f1-be76-4185-a488-a9001b105b94)
which can launch BaaUpdate.exe, which is vulnerable to COM Hijacking when started with input parameters. This allows attackers to execute code in the user's context without needing to steal credentials or use additional techniques to compromise the account.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\BaaUpdate.exe",
    "ImageLoaded|endswith": ".dll",
    "ImageLoaded|contains": [
      ":\\Perflogs\\",
      ":\\Users\\Default\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp\\",
      "\\AppData\\Roaming\\",
      "\\Contacts\\",
      "\\Favorites\\",
      "\\Favourites\\",
      "\\Links\\",
      "\\Music\\",
      "\\Pictures\\",
      "\\ProgramData\\",
      "\\Temporary Internet",
      "\\Videos\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/rtecCyberSec/BitlockMove
Sigma Detection Rule: Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2024-04-15
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe".
Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\KeyScrambler.exe",
      "\\KeyScramblerLogon.exe"
    ],
    "ImageLoaded|endswith": "\\KeyScramblerIE.dll"
  },
  "filter_main_legitimate_path": {
    "Image|contains": [
      "C:\\Program Files (x86)\\KeyScrambler\\",
      "C:\\Program Files\\KeyScrambler\\"
    ],
    "ImageLoaded|contains": [
      "C:\\Program Files (x86)\\KeyScrambler\\",
      "C:\\Program Files\\KeyScrambler\\"
    ]
  },
  "filter_main_signature": {
    "Signature": "QFX Software Corporation",
    "SignatureStatus": "Valid"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html
  - https://csirt-cti.net/2024/02/01/stately-taurus-continued-new-information-on-cyberespionage-attacks-against-myanmar-military-junta/
  - https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/
  - https://twitter.com/Max_Mal_/status/[PII_REDACTED]39291859
  - https://twitter.com/DTCERT/status/[PII_REDACTED]95839339
Sigma Detection Rule: Unsigned Module Loaded by ClickOnce Application
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @SerkinValery
Date: 2023-06-08
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects unsigned module load by ClickOnce application.

Detection logic:
{
  "selection_path": {
    "Image|contains": "\\AppData\\Local\\Apps\\2.0\\"
  },
  "selection_sig_status": [
    {
      "Signed": "false"
    },
    {
      "SignatureStatus": "Expired"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
Sigma Detection Rule: VBA DLL Loaded Via Office Application
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Antonlovesdnb
Date: 2020-02-19
ATT&CK techniques: T1204.002
Log source: windows/image_load

Description:
Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\excel.exe",
      "\\mspub.exe",
      "\\onenote.exe",
      "\\onenoteim.exe",
      "\\outlook.exe",
      "\\powerpnt.exe",
      "\\winword.exe"
    ],
    "ImageLoaded|endswith": [
      "\\VBE7.DLL",
      "\\VBEUI.DLL",
      "\\VBE7INTL.DLL"
    ]
  },
  "condition": "selection"
}

References:
  - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
Sigma Detection Rule: HackTool - SharpEvtMute DLL Load
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-09-07
ATT&CK techniques: T1685.001
Log source: windows/image_load

Description:
Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs

Detection logic:
{
  "selection": {
    "Hashes|contains": "IMPHASH=330768A4F172E10ACB6287B87289D83B"
  },
  "condition": "selection"
}

References:
  - https://github.com/bats3c/EvtMute
Sigma Detection Rule: WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-09-02
ATT&CK techniques: T1546.003
Log source: windows/image_load

Description:
Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\scrcons.exe",
    "ImageLoaded|endswith": [
      "\\vbscript.dll",
      "\\wbemdisp.dll",
      "\\wshom.ocx",
      "\\scrrun.dll"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/HunterPlaybook/status/[PII_REDACTED]55759107
  - https://www.mdsec.co.uk/2020/09/i-like-to-move-it-windows-lateral-movement-part-1-wmi-event-subscription/
  - https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html
Sigma Detection Rule: Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Perez Diego (@darkquassar), oscd.community, Ecco
Date: 2019-10-27
ATT&CK techniques: T1003.001
Log source: windows/image_load

Description:
Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes.
Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll.
As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.


Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": [
      "\\dbghelp.dll",
      "\\dbgcore.dll"
    ],
    "Signed": "false"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
  - https://www.pinvoke.net/default.aspx/dbghelp/MiniDumpWriteDump.html
  - https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6
Sigma Detection Rule: Unsigned .node File Loaded
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Jonathan Beierle (@hullabrian)
Date: 2025-11-22
ATT&CK techniques: T1129, T1574.001, T1036.005
Log source: windows/image_load

Description:
Detects the loading of unsigned .node files.
Adversaries may abuse a lack of .node integrity checking to execute arbitrary code inside of trusted applications such as Slack.
.node files are native add-ons for Electron-based applications, which are commonly used for desktop applications like Slack, Discord, and Visual Studio Code.
This technique has been observed in the DripLoader malware, which uses unsigned .node files to load malicious native code into Electron applications.


Detection logic:
{
  "selection_node_extension": {
    "ImageLoaded|endswith": ".node"
  },
  "selection_status": [
    {
      "Signed": "false"
    },
    {
      "SignatureStatus": "Unavailable"
    }
  ],
  "filter_optional_vscode_jupyter": {
    "Image|endswith": "\\Code.exe",
    "ImageLoaded|contains": ".vscode\\extensions\\ms-toolsai.jupyter-",
    "ImageLoaded|endswith": [
      "\\electron.napi.node",
      "\\node.napi.glibc.node"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://www.coreycburton.com/blog/driploader-case-study
  - https://github.com/CoreyCBurton/DripLoaderNG
  - https://www.electronjs.org/docs/latest/tutorial/native-code-and-electron