Date: 08/09/2024
Severity: Medium
Summary
The "Potential DLL Sideloading Of DbgModel.DLL" issue refers to a vulnerability where a legitimate application might be tricked into loading a malicious DLL (Dynamic Link Library) file in place of the intended DbgModel.DLL. This could occur if an attacker places a malicious DLL in a directory that the application searches for DLLs, leading to potential exploitation. The attacker could gain unauthorized access or execute arbitrary code with the application's privileges. Proper mitigation involves validating the origin and integrity of DLL files and implementing security measures to prevent unauthorized DLL loading.
Indicators of Compromise (IOC) List
ImageLoaded | \dbgmodel.dll C:\Windows\System32\ C:\Windows\SysWOW64\ C:\Windows\WinSxS\ C:\Program Files\WindowsApps\Microsoft.WinDbg_ C:\Program Files (x86)\Windows Kits\ C:\Program Files\Windows Kits\ C:\Program Files\Dell\DTP\InstrumentationSubAgent\ |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 | resourcename in ("Sysmon") and eventtype = "7" and Imageloaded in ("\dbgmodel.dll", "C:\Windows\System32", "C:\Windows\SysWOW64", "C:\Windows\WinSxS", "C:\Program Files\WindowsApps\Microsoft.WinDbg_") |
Detection Query 2 | resourcename in ("Sysmon") and eventtype = "7" and Imageloaded in ("\dbgmodel.dll", "C:\Windows\System32", "C:\Windows\SysWOW64", "C:\Windows\WinSxS", "C:\Program Files (x86)\Windows Kits", "C:\Program Files\Windows Kits") |
Detection Query 3 | resourcename in ("Sysmon") and eventtype = "7" and Imageloaded in ("\dbgmodel.dll", "C:\Windows\System32", "C:\Windows\SysWOW64", "C:\Windows\WinSxS", "C:\Program Files\Dell\DTP\InstrumentationSubAgent") |
Detection Query 4 | technologygroup = "EDR" and Imageloaded in ("\dbgmodel.dll", "C:\Windows\System32", "C:\Windows\SysWOW64", "C:\Windows\WinSxS", "C:\Program Files\WindowsApps\Microsoft.WinDbg_") |
Detection Query 5 | technologygroup = "EDR" and Imageloaded in ("\dbgmodel.dll", "C:\Windows\System32", "C:\Windows\SysWOW64", "C:\Windows\WinSxS", "C:\Program Files (x86)\Windows Kits", "C:\Program Files\Windows Kits") |
Detection Query 6 | technologygroup = "EDR" and Imageloaded in ("\dbgmodel.dll", "C:\Windows\System32", "C:\Windows\SysWOW64", "C:\Windows\WinSxS", "C:\Program Files\Dell\DTP\InstrumentationSubAgent") |
Reference:
https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_dbgmodel.yml