Skip to content

Commit c5b8810

Browse files
swachchhanda000phantinuss
swachchhanda000
and
phantinuss
authored
Merge PR SigmaHQ#5777 from @swachchhanda000 - feat: more edrfreeze rules
new: WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze new: Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location new: Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs new: Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze update: Hacktool - EDR-Freeze Execution - add more coverage --------- Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>
1 parent cce4545 commit c5b8810

29 files changed

+721
-2
lines changed

‎.github/workflows/known-FPs.csv‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,3 +73,4 @@ de587dce-915e-4218-aac4-835ca6af6f70;Potential Persistence Attempt Via Run Keys
7373
8fbf3271-1ef6-4e94-8210-03c2317947f6;Cred Dump Tools Dropped Files;Svchost\.exe
7474
c7da8edc-49ae-45a2-9e61-9fd860e4e73d;PUA - Sysinternals Tools Execution - Registry;.*
7575
dcff7e85-d01f-4eb5-badd-84e2e6be8294;Windows Default Domain GPO Modification via GPME;Computer: WIN-FPV0DSIC9O6.sigma.fr
76+
416bc4a2-7217-4519-8dc7-c3271817f1d5;Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location;procexp64\.exe

‎regression_data/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load/416bc4a2-7217-4519-8dc7-c3271817f1d5.evtx‎

68 KB
Binary file not shown.

‎regression_data/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load/416bc4a2-7217-4519-8dc7-c3271817f1d5.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"Event": {
3+
"#attributes": {
4+
"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
5+
},
6+
"System": {
7+
"Provider": {
8+
"#attributes": {
9+
"Name": "Microsoft-Windows-Sysmon",
10+
"Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9"
11+
}
12+
},
13+
"EventID": 7,
14+
"Version": 3,
15+
"Level": 4,
16+
"Task": 7,
17+
"Opcode": 0,
18+
"Keywords": "0x8000000000000000",
19+
"TimeCreated": {
20+
"#attributes": {
21+
"SystemTime": "2025-11-27T07:57:32.309580Z"
22+
}
23+
},
24+
"EventRecordID": 676402,
25+
"Correlation": null,
26+
"Execution": {
27+
"#attributes": {
28+
"ProcessID": 3544,
29+
"ThreadID": 4264
30+
}
31+
},
32+
"Channel": "Microsoft-Windows-Sysmon/Operational",
33+
"Computer": "swachchhanda",
34+
"Security": {
35+
"#attributes": {
36+
"UserID": "S-1-5-18"
37+
}
38+
}
39+
},
40+
"EventData": {
41+
"RuleName": "-",
42+
"UtcTime": "2025-11-27 07:57:32.308",
43+
"ProcessGuid": "0197231E-046C-6928-160C-000000000D00",
44+
"ProcessId": 296,
45+
"Image": "C:\\Users\\Public\\wsass\\WerFaultSecure.exe",
46+
"ImageLoaded": "C:\\Windows\\System32\\dbgcore.dll",
47+
"FileVersion": "10.0.26100.7019 (WinBuild.160101.0800)",
48+
"Description": "Windows Core Debugging Helpers",
49+
"Product": "Microsoft® Windows® Operating System",
50+
"Company": "Microsoft Corporation",
51+
"OriginalFileName": "DBGCORE.DLL",
52+
"Hashes": "SHA1=5E4F2C531C549BB72A658ED9DD16D491EDDBB286,MD5=FAB4B30C1C4F0A9202A7B42DCF1729DC,SHA256=1B48A4F8D20026E6C56E3AB4CC4788FA6425C8A75F8D91C2869FA533DE6B209E,IMPHASH=C324AAAC01F0F75C811E1F80C41B860C",
53+
"Signed": "true",
54+
"Signature": "Microsoft Windows",
55+
"SignatureStatus": "Valid",
56+
"User": "swachchhanda\\xodih"
57+
}
58+
}
59+
}

‎regression_data/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load/info.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
id: bc1c627e-6529-459d-9bd6-74ffb88b3320
2+
description: N/A
3+
date: 2025-11-27
4+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
5+
rule_metadata:
6+
- id: 416bc4a2-7217-4519-8dc7-c3271817f1d5
7+
title: Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location
8+
regression_tests_info:
9+
- name: Positive Detection Test
10+
type: evtx
11+
provider: Microsoft-Windows-Sysmon
12+
path: regression_data/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load/416bc4a2-7217-4519-8dc7-c3271817f1d5.evtx

‎regression_data/rules/windows/image_load/image_load_win_werfaultsecure_dbgcore_dbghelp_load/8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b.evtx‎

68 KB
Binary file not shown.

‎regression_data/rules/windows/image_load/image_load_win_werfaultsecure_dbgcore_dbghelp_load/8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"Event": {
3+
"#attributes": {
4+
"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
5+
},
6+
"System": {
7+
"Provider": {
8+
"#attributes": {
9+
"Name": "Microsoft-Windows-Sysmon",
10+
"Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9"
11+
}
12+
},
13+
"EventID": 7,
14+
"Version": 3,
15+
"Level": 4,
16+
"Task": 7,
17+
"Opcode": 0,
18+
"Keywords": "0x8000000000000000",
19+
"TimeCreated": {
20+
"#attributes": {
21+
"SystemTime": "2025-11-27T07:40:10.165324Z"
22+
}
23+
},
24+
"EventRecordID": 571146,
25+
"Correlation": null,
26+
"Execution": {
27+
"#attributes": {
28+
"ProcessID": 3544,
29+
"ThreadID": 4272
30+
}
31+
},
32+
"Channel": "Microsoft-Windows-Sysmon/Operational",
33+
"Computer": "swachchhanda",
34+
"Security": {
35+
"#attributes": {
36+
"UserID": "S-1-5-18"
37+
}
38+
}
39+
},
40+
"EventData": {
41+
"RuleName": "-",
42+
"UtcTime": "2025-11-27 07:40:10.132",
43+
"ProcessGuid": "0197231E-005A-6928-A50B-000000000D00",
44+
"ProcessId": 4460,
45+
"Image": "C:\\Windows\\System32\\WerFaultSecure.exe",
46+
"ImageLoaded": "C:\\Windows\\System32\\dbgcore.dll",
47+
"FileVersion": "10.0.26100.7019 (WinBuild.160101.0800)",
48+
"Description": "Windows Core Debugging Helpers",
49+
"Product": "Microsoft® Windows® Operating System",
50+
"Company": "Microsoft Corporation",
51+
"OriginalFileName": "DBGCORE.DLL",
52+
"Hashes": "SHA1=5E4F2C531C549BB72A658ED9DD16D491EDDBB286,MD5=FAB4B30C1C4F0A9202A7B42DCF1729DC,SHA256=1B48A4F8D20026E6C56E3AB4CC4788FA6425C8A75F8D91C2869FA533DE6B209E,IMPHASH=C324AAAC01F0F75C811E1F80C41B860C",
53+
"Signed": "true",
54+
"Signature": "Microsoft Windows",
55+
"SignatureStatus": "Valid",
56+
"User": "swachchhanda\\xodih"
57+
}
58+
}
59+
}

‎regression_data/rules/windows/image_load/image_load_win_werfaultsecure_dbgcore_dbghelp_load/info.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
id: 63b16abe-2d5c-4a2f-b0ae-f1bc4580e40c
2+
description: N/A
3+
date: 2025-11-27
4+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
5+
rule_metadata:
6+
- id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b
7+
title: WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze
8+
regression_tests_info:
9+
- name: Positive Detection Test
10+
type: evtx
11+
provider: Microsoft-Windows-Sysmon
12+
path: regression_data/rules/windows/image_load/image_load_win_werfaultsecure_dbgcore_dbghelp_load/8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b.evtx

‎regression_data/rules/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load/9f5c1d59-33be-4e60-bcab-85d2f566effd.evtx‎

68 KB
Binary file not shown.

‎regression_data/rules/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load/9f5c1d59-33be-4e60-bcab-85d2f566effd.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"Event": {
3+
"#attributes": {
4+
"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
5+
},
6+
"System": {
7+
"Provider": {
8+
"#attributes": {
9+
"Name": "Microsoft-Windows-Sysmon",
10+
"Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9"
11+
}
12+
},
13+
"EventID": 10,
14+
"Version": 3,
15+
"Level": 4,
16+
"Task": 10,
17+
"Opcode": 0,
18+
"Keywords": "0x8000000000000000",
19+
"TimeCreated": {
20+
"#attributes": {
21+
"SystemTime": "2025-11-27T07:57:32.317336Z"
22+
}
23+
},
24+
"EventRecordID": 676404,
25+
"Correlation": null,
26+
"Execution": {
27+
"#attributes": {
28+
"ProcessID": 3544,
29+
"ThreadID": 4264
30+
}
31+
},
32+
"Channel": "Microsoft-Windows-Sysmon/Operational",
33+
"Computer": "swachchhanda",
34+
"Security": {
35+
"#attributes": {
36+
"UserID": "S-1-5-18"
37+
}
38+
}
39+
},
40+
"EventData": {
41+
"RuleName": "-",
42+
"UtcTime": "2025-11-27 07:57:32.315",
43+
"SourceProcessGUID": "0197231E-046C-6928-160C-000000000D00",
44+
"SourceProcessId": 296,
45+
"SourceThreadId": 5260,
46+
"SourceImage": "C:\\Users\\Public\\wsass\\WerFaultSecure.exe",
47+
"TargetProcessGUID": "0197231E-2DD5-691E-0C00-000000000D00",
48+
"TargetProcessId": 860,
49+
"TargetImage": "C:\\WINDOWS\\system32\\lsass.exe",
50+
"GrantedAccess": "0x1fffff",
51+
"CallTrace": "C:\\WINDOWS\\SYSTEM32\\ntdll.dll+16bcc4|C:\\WINDOWS\\SYSTEM32\\ntdll.dll+17aee0|C:\\WINDOWS\\SYSTEM32\\KERNEL32.DLL+7f7dc|C:\\WINDOWS\\SYSTEM32\\KERNEL32.DLL+c8d28|C:\\WINDOWS\\SYSTEM32\\dbgcore.DLL+44c34|C:\\WINDOWS\\SYSTEM32\\dbgcore.DLL+48f2c|C:\\WINDOWS\\SYSTEM32\\dbgcore.DLL+3d414|C:\\WINDOWS\\SYSTEM32\\dbgcore.DLL+29c7c|C:\\WINDOWS\\SYSTEM32\\dbgcore.DLL+2a1f0|C:\\WINDOWS\\SYSTEM32\\dbgcore.DLL+4f894|C:\\Users\\Public\\wsass\\WerFaultSecure.exe+3a64|C:\\Users\\Public\\wsass\\WerFaultSecure.exe+2576|C:\\Users\\Public\\wsass\\WerFaultSecure.exe+20c9|C:\\Users\\Public\\wsass\\WerFaultSecure.exe+1a0b|C:\\Users\\Public\\wsass\\WerFaultSecure.exe+48cc|C:\\WINDOWS\\SYSTEM32\\KERNEL32.DLL+f17ac",
52+
"SourceUser": "swachchhanda\\xodih",
53+
"TargetUser": "NT AUTHORITY\\SYSTEM"
54+
}
55+
}
56+
}

‎regression_data/rules/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load/info.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
id: f0a580dc-386c-4049-8ca4-cef9f956dc4c
2+
description: N/A
3+
date: 2025-11-27
4+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
5+
rule_metadata:
6+
- id: 9f5c1d59-33be-4e60-bcab-85d2f566effd
7+
title: Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs
8+
regression_tests_info:
9+
- name: Positive Detection Test
10+
type: evtx
11+
provider: Microsoft-Windows-Sysmon
12+
path: regression_data/rules/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load/9f5c1d59-33be-4e60-bcab-85d2f566effd.evtx

0 commit comments

Comments
 (0)