huntrule

Malicious PowerShell Runtime Loaded Outside PowerShell Host

PremiumReviewedSigma · High · v1
Product
windows
Category
image_load
Author
HuntRule
Published
2026-10-02
Updated
2026-10-02
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the System.Management.Automation.dll PowerShell runtime being loaded by a process other than a legitimate PowerShell host, the unmanaged PowerShell technique used by Cobalt Strike to execute PowerShell in memory without spawning powershell.exe. Running PowerShell inside an arbitrary process evades monitoring that watches the PowerShell binary. A non-host process loading the automation assembly is a strong injection indicator.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious AutoIt Interpreter Launched by Script Host or Shell
Windows PowerShell Base64-encoded shellcode in ScriptBlockText
Suspicious Scheduled Task Creation in Public Writable Directory via schtasks (via process_creation)
Suspicious Base64 Encoded PowerShell Command Linked to Chinese APT Techniques
Suspicious Scheduled Task Executing Payload from AppData
Suspicious PowerShell Harvesting RDP Logon Events via Get-WinEvent
Suspicious PowerShell Web Request to oastify Out-of-Band Domain
Suspicious PowerShell Execution of Untitled1 Script From ProgramData
Suspicious PowerShell Spawned by Komari Monitoring Agent
Malicious PowerShell Runtime Loaded Outside PowerShell Host
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.