VMMap Unsigned Dbghelp.DLL Potential Sideloading

Title: VMMap Unsigned Dbghelp.DLL Potential Sideloading
Status: test
Description:Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.
References:
  -https://techcommunity.microsoft.com/t5/sysinternals-blog/zoomit-v7-1-procdump-2-0-for-linux-process-explorer-v17-05/ba-p/3884766
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-28
modified:2023-09-05
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.001'

Logsource:

• category: image_load
• product: windows

Detection:
  selection:
    ImageLoaded|contains: 'C:\Debuggers\dbghelp.dll'
    Image|endswith:
      -'\vmmap.exe'
      -'\vmmap64.exe'

  filter_main_signed:
    Signed: 'true'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: high