Suspicious PowerShell Core DLL Loaded By Non PowerShell Process (via image_load)

title: Suspicious PowerShell Core DLL Loaded By Non PowerShell Process (via image_load)
id: a04a6aa3-fd79-5da3-a488-3bb06f910c85
status: stable
description: This rule detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter's "load powershell" extension.
references:
    - https://attack.mitre.org/techniques/T1059/001/
    - https://adsecurity.org/?p=2921
    - https://github.com/p3nt4/PowerShdll
author: Huntrule Team
date: 2026-02-07
tags:
    - attack.t1059.001
    - attack.execution
logsource:
    category: image_load
    product: windows
detection:
    selection:
        - Description: 'System.Management.Automation'
        - OriginalFileName: 'System.Management.Automation.dll'
        - ImageLoaded|endswith:
              - '\System.Management.Automation.dll'
              - '\System.Management.Automation.ni.dll'
    filter_main_powershell:
        Image:
            - 'C:\Program Files\PowerShell\7-preview\pwsh.exe'
            - 'C:\Program Files\PowerShell\7\pwsh.exe'
            - 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe'
            - 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
            - 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe'
            - 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe'
    filter_main_pwsh_preview:
        Image|contains:
            - 'C:\Program Files\WindowsApps\Microsoft.PowerShellPreview'
            - '\AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview'
        Image|endswith: '\pwsh.exe'
    filter_main_generic:
        Image:
            - 'C:\Windows\System32\dsac.exe'
            - 'C:\WINDOWS\System32\RemoteFXvGPUDisablement.exe'
            - 'C:\Windows\System32\runscripthelper.exe'
            - 'C:\WINDOWS\System32\sdiagnhost.exe'
            - 'C:\Windows\System32\ServerManager.exe'
            - 'C:\Windows\System32\SyncAppvPublishingServer.exe'
            - 'C:\Windows\System32\winrshost.exe'
            - 'C:\Windows\System32\wsmprovhost.exe'
            - 'C:\Windows\SysWOW64\winrshost.exe'
            - 'C:\Windows\SysWOW64\wsmprovhost.exe'
    filter_main_dotnet:
        Image|startswith:
            - 'C:\Windows\Microsoft.NET\Framework\'
            - 'C:\Windows\Microsoft.NET\FrameworkArm\'
            - 'C:\Windows\Microsoft.NET\FrameworkArm64\'
            - 'C:\Windows\Microsoft.NET\Framework64\'
        Image|endswith: '\mscorsvw.exe'
    filter_optional_sql_server_mgmt:
        Image|startswith:
            - 'C:\Program Files (x86)\Microsoft SQL Server Management Studio'
            - 'C:\Program Files\Microsoft SQL Server Management Studio'
        Image|endswith: '\IDE\Ssms.exe'
    filter_optional_sql_server_tools:
        Image|startswith:
            - 'C:\Program Files (x86)\Microsoft SQL Server\'
            - 'C:\Program Files\Microsoft SQL Server\'
        Image|endswith: '\Tools\Binn\SQLPS.exe'
    filter_optional_citrix:
        Image|endswith: '\Citrix\ConfigSync\ConfigSyncRun.exe'
    filter_optional_vs:
        Image|startswith:
            - 'C:\Program Files (x86)\Microsoft Visual Studio\'
            - 'C:\Program Files\Microsoft Visual Studio\'
    filter_optional_chocolatey:
        Image|startswith: 'C:\ProgramData\chocolatey\choco.exe'
    filter_optional_nextron:
        Image|startswith: 'C:\Windows\Temp\asgard2-agent\'
        Image|endswith:
            - '\thor64.exe'
            - '\thor.exe'
    filter_optional_aurora:
        Image:
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium