PowerShell Core DLL Loaded by Office Applications on Windows

title: PowerShell Core DLL Loaded by Office Applications on Windows
id: 66884679-9e07-4ae6-8fee-f04357945450
status: test
description: This rule identifies Windows processes running Microsoft Office executables that load PowerShell core automation DLLs. Attackers may use Office-launched code execution to bring PowerShell functionality into a trusted process for stealth and capability expansion. It relies on image load telemetry capturing the parent executable name and the presence of specific PowerShell DLL paths in loaded modules.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_office_powershell_dll_load.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-01
tags:
  - attack.stealth
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith:
      - \excel.exe
      - \mspub.exe
      - \outlook.exe
      - \onenote.exe
      - \onenoteim.exe
      - \powerpnt.exe
      - \winword.exe
    ImageLoaded|contains:
      - \System.Management.Automation.Dll
      - \System.Management.Automation.ni.Dll
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: bb2ba6fb-95d4-4a25-89fc-30bb736c021a
    type: derived