Windows: PowerShell Core DLL Loaded by Office Application
Flags Office apps that load System.Management.Automation DLLs associated with PowerShell Core.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- image_load
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-01
- Updated
- 2026-07-31
What it detects
This rule identifies when a Microsoft Office application process loads PowerShell core-related DLLs, specifically System.Management.Automation.Dll and System.Management.Automation.ni.Dll. Such DLL loads can indicate PowerShell execution or abuse initiated from within Office, a common user-facing entry point for stealthy tradecraft. It relies on image-load telemetry that records the target process (Excel, Outlook, Word, PowerPoint, OneNote, Publisher) and the DLL path contained in the loaded module.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
powershell-core-dll-loaded-by-office-applications-on-windows-bb2ba6fb
title: "Windows: PowerShell Core DLL Loaded by Office Application"
id: 66884679-9e07-4ae6-8fee-f04357945450
status: test
description: This rule identifies when a Microsoft Office application process loads PowerShell core-related DLLs, specifically System.Management.Automation.Dll and System.Management.Automation.ni.Dll. Such DLL loads can indicate PowerShell execution or abuse initiated from within Office, a common user-facing entry point for stealthy tradecraft. It relies on image-load telemetry that records the target process (Excel, Outlook, Word, PowerPoint, OneNote, Publisher) and the DLL path contained in the loaded module.
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_office_powershell_dll_load.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-01
tags:
- attack.stealth
logsource:
category: image_load
product: windows
detection:
selection:
Image|endswith:
- \excel.exe
- \mspub.exe
- \outlook.exe
- \onenote.exe
- \onenoteim.exe
- \powerpnt.exe
- \winword.exe
ImageLoaded|contains:
- \System.Management.Automation.Dll
- \System.Management.Automation.ni.Dll
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: bb2ba6fb-95d4-4a25-89fc-30bb736c021a
type: derived