Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded

Title: Suspicious Unsigned Dbghelp/Dbgcore DLL Loaded
Status: test
Description:Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes. Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll. As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.
References:
  -https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
  -https://www.pinvoke.net/default.aspx/dbghelp/MiniDumpWriteDump.html
  -https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6
Author: Perez Diego (@darkquassar), oscd.community, Ecco
Date: 2019-10-27
modified:2022-12-09
Tags:

• -'attack.credential-access'
• -'attack.t1003.001'

Logsource:

• category: image_load
• product: windows

Detection:
  selection:
    ImageLoaded|endswith:
      -'\dbghelp.dll'
      -'\dbgcore.dll'

    Signed: 'false'
  condition:selection
Falsepositives:
  -Unknown
Level: high