{"id":"092bc4b9-3d1d-43b4-a6b4-8c8acd83522f","title":"PowerShell Core DLL Loaded By Non PowerShell Process","description":"Detects loading of essential DLLs used by PowerShell by non-PowerShell process.\nDetects behavior similar to meterpreter's \"load powershell\" extension.\n","author":"Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2019-11-14","modified":"2025-10-07","tags":["attack.t1059.001","attack.execution"],"technique_ids":["T1059.001"],"logsource":{"category":"image_load","product":"windows"},"falsepositives":["Used by some .NET binaries, minimal on user workstation.","Used by Microsoft SQL Server Management Studio"],"references":["https://adsecurity.org/?p=2921","https://github.com/p3nt4/PowerShdll"],"source_path":"rules/windows/image_load/image_load_dll_system_management_automation_susp_load.yml","source_sha256":"414446e48dd1c816f4d22776d68eabd0a96e235c4a4071b41158d9e6cc567da8","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_dll_system_management_automation_susp_load.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PowerShell Core DLL Loaded By Non PowerShell Process\nid: 092bc4b9-3d1d-43b4-a6b4-8c8acd83522f\nrelated:\n    - id: 867613fb-fa60-4497-a017-a82df74a172c\n      type: obsolete\n    - id: fe6e002f-f244-4278-9263-20e4b593827f\n      type: obsolete\nstatus: test\ndescription: |\n    Detects loading of essential DLLs used by PowerShell by non-PowerShell process.\n    Detects behavior similar to meterpreter's \"load powershell\" extension.\nreferences:\n    - https://adsecurity.org/?p=2921\n    - https://github.com/p3nt4/PowerShdll\nauthor: Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)\ndate: 2019-11-14\nmodified: 2025-10-07\ntags:\n    - attack.t1059.001\n    - attack.execution\nlogsource:\n    category: image_load\n    product: windows\ndetection:\n    selection:\n        - Description: 'System.Management.Automation'\n        - OriginalFileName: 'System.Management.Automation.dll'\n        - ImageLoaded|endswith:\n              - '\\System.Management.Automation.dll'\n              - '\\System.Management.Automation.ni.dll'\n    filter_main_powershell:\n        Image:\n            - 'C:\\Program Files\\PowerShell\\7-preview\\pwsh.exe' # PowerShell 7 preview\n            - 'C:\\Program Files\\PowerShell\\7\\pwsh.exe' # PowerShell 7\n            - 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe'\n            - 'C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'\n            - 'C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell_ise.exe'\n            - 'C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe'\n    filter_main_pwsh_preview:\n        Image|contains:\n            - 'C:\\Program Files\\WindowsApps\\Microsoft.PowerShellPreview'\n            - '\\AppData\\Local\\Microsoft\\WindowsApps\\Microsoft.PowerShellPreview'\n        Image|endswith: '\\pwsh.exe'\n    filter_main_generic:\n        Image:\n            - 'C:\\Windows\\System32\\dsac.exe'\n            - 'C:\\WINDOWS\\System32\\RemoteFXvGPUDisablement.exe'\n            - 'C:\\Windows\\System32\\runscripthelper.exe'\n            - 'C:\\WINDOWS\\System32\\sdiagnhost.exe'\n            - 'C:\\Windows\\System32\\ServerManager.exe'\n            - 'C:\\Windows\\System32\\SyncAppvPublishingServer.exe'\n            - 'C:\\Windows\\System32\\winrshost.exe'\n            - 'C:\\Windows\\System32\\wsmprovhost.exe'\n            - 'C:\\Windows\\SysWOW64\\winrshost.exe'\n            - 'C:\\Windows\\SysWOW64\\wsmprovhost.exe'\n    filter_main_dotnet:\n        Image|startswith:\n            - 'C:\\Windows\\Microsoft.NET\\Framework\\'\n            - 'C:\\Windows\\Microsoft.NET\\FrameworkArm\\'\n            - 'C:\\Windows\\Microsoft.NET\\FrameworkArm64\\'\n            - 'C:\\Windows\\Microsoft.NET\\Framework64\\'\n        Image|endswith: '\\mscorsvw.exe'\n    filter_optional_sql_server_mgmt:\n        Image|startswith:\n            - 'C:\\Program Files (x86)\\Microsoft SQL Server Management Studio'\n            - 'C:\\Program Files\\Microsoft SQL Server Management Studio'\n        Image|endswith: '\\IDE\\Ssms.exe'\n    filter_optional_sql_server_tools:\n        Image|startswith:\n            - 'C:\\Program Files (x86)\\Microsoft SQL Server\\'\n            - 'C:\\Program Files\\Microsoft SQL Server\\'\n        Image|endswith: '\\Tools\\Binn\\SQLPS.exe'\n    filter_optional_citrix:\n        Image|endswith: '\\Citrix\\ConfigSync\\ConfigSyncRun.exe'\n    filter_optional_vs:\n        Image|startswith:\n            - 'C:\\Program Files (x86)\\Microsoft Visual Studio\\'\n            - 'C:\\Program Files\\Microsoft Visual Studio\\'\n    filter_optional_chocolatey:\n        Image|startswith: 'C:\\ProgramData\\chocolatey\\choco.exe'\n    filter_optional_nextron:\n        Image|startswith: 'C:\\Windows\\Temp\\asgard2-agent\\'\n        Image|endswith:\n            - '\\thor64.exe'\n            - '\\thor.exe'\n        # User: 'NT AUTHORITY\\SYSTEM'   # if set, matches all powershell processes not launched by SYSTEM\n    filter_optional_aurora:\n        # This filter is to avoid a race condition FP with this specific ETW provider in aurora\n        Image: null\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Used by some .NET binaries, minimal on user workstation.\n    - Used by Microsoft SQL Server Management Studio\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/092bc4b9-3d1d-43b4-a6b4-8c8acd83522f.json","kind":"sigma"}