Suspicious Loading of Dbgcore or Dbghelp DLLs from Uncommon Location
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories.
Severity
Trouble
Rule Requirement
Criteria
Action1:
actionname = "Image Loaded" AND ( OBJECTNAME endswith "\dbgcore.dll,\dbghelp.dll" ) AND ( OBJECTNAME contains ":\Perflogs,:\Temp,:\Users\Public,$Recycle.Bin,\Contacts,\Documents,\Favorites,\Favourites" OR OBJECTNAME contains "\inetpub\wwwroot,\Music,\Pictures,\Start Menu\Programs\Startup,\Users\Default,\Videos,\AppData\Local\Temp" )
select Action1.HOSTNAME,Action1.MESSAGE,Action1.PROCESSNAME,Action1.PRODUCT_NAME,Action1.OBJECTNAME,Action1.SIGNATURE,Action1.SIGNATURESTATUS
Detection
Execution Mode
realtime
Log Sources
Windows
Author
@Swachchhanda Shrawan Poudel (Nextron Systems)
