From c59194976bb05e229dc23272c79c0d2db268ceb2 Mon Sep 17 00:00:00 2001
From: Swachchhanda Shrawan Poudel <swachchhandashrawan@gmail.com>
Date: Thu, 23 Nov 2023 13:27:42 +0545
Subject: [PATCH] included image load of dbghelp.dll or dbgcore.dll

---
 7_image_load/include_minidumpwritedump.xml | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 7_image_load/include_minidumpwritedump.xml

diff --git a/7_image_load/include_minidumpwritedump.xml b/7_image_load/include_minidumpwritedump.xml
new file mode 100644
index 00000000..7130d203
--- /dev/null
+++ b/7_image_load/include_minidumpwritedump.xml
@@ -0,0 +1,10 @@
+<Sysmon schemaversion="4.30">
+    <EventFiltering>
+      <RuleGroup name="" groupRelation="or">
+        <ImageLoad onmatch="include">
+            <ImageLoaded name="technique_id=T1003,technique_name=Credential Dumping" condition="contains any">dbghelp.dll;dbgcore.dll</ImageLoaded>	<!--https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_dbghelp_dbgcore_susp_load.yml--> 
+        </ImageLoad>
+      </RuleGroup>
+    </EventFiltering>
+  </Sysmon>
+  
\ No newline at end of file