Suspicious Amsi.DLL Loaded Through LOLBIN Process (via image_load)

title: Suspicious Amsi.DLL Loaded Through LOLBIN Process (via image_load)
id: ffab702e-67bd-5164-ab15-eb3832241740
status: stable
description: This rule detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack
references:
    - Internal Research
    - https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/
author: Huntrule Team
date: 2026-06-08
tags:
    - attack.defense-impairment
    - attack.defense-evasion
    - attack.t1562.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\amsi.dll'
        Image|endswith:
            - '\ExtExport.exe'
            - '\odbcconf.exe'
            - '\rundll32.exe'
    condition: selection
falsepositives:
    - Unknown
level: medium