Title:
PowerShell Core DLL Loaded By Non PowerShell Process
Status:
test
Description:Detects loading of essential DLLs used by PowerShell by non-PowerShell process.
Detects behavior similar to meterpreter's "load powershell" extension.
References:
-https://adsecurity.org/?p=2921
-https://github.com/p3nt4/PowerShdll
Author: Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2019-11-14
modified:2026-07-28
Tags:
- -'attack.t1059.001'
- -'attack.execution'
Logsource:
- category: image_load
- product: windows
Detection:
selection:
Description:
'System.Management.Automation'
OriginalFileName:
'System.Management.Automation.dll'
- ImageLoaded|endswith:
- '\System.Management.Automation.dll'
- '\System.Management.Automation.ni.dll'
filter_main_powershell:
Image:
-'C:\Program Files\PowerShell\7-preview\pwsh.exe'
-'C:\Program Files\PowerShell\7\pwsh.exe'
-'C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe'
-'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
-'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe'
-'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe'
filter_main_pwsh_preview:
Image|contains:
-'C:\Program Files\WindowsApps\Microsoft.PowerShellPreview'
-'\AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview'
Image|endswith:
'\pwsh.exe'
filter_main_generic:
Image:
-'C:\Windows\System32\dsac.exe'
-'C:\WINDOWS\System32\RemoteFXvGPUDisablement.exe'
-'C:\Windows\System32\runscripthelper.exe'
-'C:\WINDOWS\System32\sdiagnhost.exe'
-'C:\Windows\System32\ServerManager.exe'
-'C:\Windows\System32\SyncAppvPublishingServer.exe'
-'C:\Windows\System32\winrshost.exe'
-'C:\Windows\System32\wsmprovhost.exe'
-'C:\Windows\SysWOW64\winrshost.exe'
-'C:\Windows\SysWOW64\wsmprovhost.exe'
filter_main_dotnet:
Image|startswith:
-'C:\Windows\Microsoft.NET\Framework\'
-'C:\Windows\Microsoft.NET\FrameworkArm\'
-'C:\Windows\Microsoft.NET\FrameworkArm64\'
-'C:\Windows\Microsoft.NET\Framework64\'
Image|endswith:
'\mscorsvw.exe'
filter_optional_gethelp:
Image|startswith:
'C:\Program Files\WindowsApps\Microsoft.GetHelp_'
Image|endswith:
'\GetHelp.exe'
filter_optional_sql_server_mgmt:
Image|startswith:
-'C:\Program Files (x86)\Microsoft SQL Server Management Studio'
-'C:\Program Files\Microsoft SQL Server Management Studio'
Image|endswith:
'\IDE\Ssms.exe'
filter_optional_sql_server_tools:
Image|startswith:
-'C:\Program Files (x86)\Microsoft SQL Server\'
-'C:\Program Files\Microsoft SQL Server\'
Image|endswith:
'\Tools\Binn\SQLPS.exe'
filter_optional_citrix:
Image|endswith:
'\Citrix\ConfigSync\ConfigSyncRun.exe'
filter_optional_vs:
Image|startswith:
-'C:\Program Files (x86)\Microsoft Visual Studio\'
-'C:\Program Files\Microsoft Visual Studio\'
filter_optional_chocolatey:
Image|startswith:
'C:\ProgramData\chocolatey\choco.exe'
filter_optional_nextron:
Image|startswith:
'C:\Windows\Temp\asgard2-agent\'
Image|endswith:
-'\thor64.exe'
-'\thor.exe'
filter_optional_aurora:
Image:
'None'
condition:
selection and not 1 of filter_main_* and not 1 of filter_optional_*
Falsepositives:
-Used by some .NET binaries, minimal on user workstation.
-Used by Microsoft SQL Server Management Studio
Level:
medium
