Windows: Non-PowerShell Process Loads PowerShell System.Management.Automation DLL

title: "Windows: Non-PowerShell Process Loads PowerShell System.Management.Automation DLL"
id: 659cd9a9-761c-4ede-b9ce-90401d1e1ad7
related:
  - id: 867613fb-fa60-4497-a017-a82df74a172c
    type: obsolete
  - id: fe6e002f-f244-4278-9263-20e4b593827f
    type: obsolete
  - id: 092bc4b9-3d1d-43b4-a6b4-8c8acd83522f
    type: derived
status: test
description: This rule flags image-load activity where a non-PowerShell process loads the PowerShell automation assembly, System.Management.Automation.dll (or its native variant). Attackers may use this behavior to bring PowerShell functionality into another process for execution, persistence, or stealth. The detection relies on Windows image load telemetry that records which DLLs were loaded and applies allowlisting for common PowerShell-related binaries to reduce false positives.
references:
  - https://adsecurity.org/?p=2921
  - https://github.com/p3nt4/PowerShdll
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_system_management_automation_susp_load.yml
author: Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2019-11-14
modified: 2026-07-28
tags:
  - attack.t1059.001
  - attack.execution
logsource:
  category: image_load
  product: windows
detection:
  selection:
    - Description: System.Management.Automation
    - OriginalFileName: System.Management.Automation.dll
    - ImageLoaded|endswith:
        - \System.Management.Automation.dll
        - \System.Management.Automation.ni.dll
  filter_main_powershell:
    Image:
      - C:\Program Files\PowerShell\7-preview\pwsh.exe
      - C:\Program Files\PowerShell\7\pwsh.exe
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  filter_main_pwsh_preview:
    Image|contains:
      - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview
      - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview
    Image|endswith: \pwsh.exe
  filter_main_generic:
    Image:
      - C:\Windows\System32\dsac.exe
      - C:\WINDOWS\System32\RemoteFXvGPUDisablement.exe
      - C:\Windows\System32\runscripthelper.exe
      - C:\WINDOWS\System32\sdiagnhost.exe
      - C:\Windows\System32\ServerManager.exe
      - C:\Windows\System32\SyncAppvPublishingServer.exe
      - C:\Windows\System32\winrshost.exe
      - C:\Windows\System32\wsmprovhost.exe
      - C:\Windows\SysWOW64\winrshost.exe
      - C:\Windows\SysWOW64\wsmprovhost.exe
  filter_main_dotnet:
    Image|startswith:
      - C:\Windows\Microsoft.NET\Framework\
      - C:\Windows\Microsoft.NET\FrameworkArm\
      - C:\Windows\Microsoft.NET\FrameworkArm64\
      - C:\Windows\Microsoft.NET\Framework64\
    Image|endswith: \mscorsvw.exe
  filter_optional_gethelp:
    Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_
    Image|endswith: \GetHelp.exe
  filter_optional_sql_server_mgmt:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft SQL Server Management Studio
      - C:\Program Files\Microsoft SQL Server Management Studio
    Image|endswith: \IDE\Ssms.exe
  filter_optional_sql_server_tools:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft SQL Server\
      - C:\Program Files\Microsoft SQL Server\
    Image|endswith: \Tools\Binn\SQLPS.exe
  filter_optional_citrix:
    Image|endswith: \Citrix\ConfigSync\ConfigSyncRun.exe
  filter_optional_vs:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft Visual Studio\
      - C:\Program Files\Microsoft Visual Studio\
  filter_optional_chocolatey:
    Image|startswith: C:\ProgramData\chocolatey\choco.exe
  filter_optional_nextron:
    Image|startswith: C:\Windows\Temp\asgard2-agent\
    Image|endswith:
      - \thor64.exe
      - \thor.exe
  filter_optional_aurora:
    Image: null
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Used by some .NET binaries, minimal on user workstation.
  - Used by Microsoft SQL Server Management Studio
level: medium
license: DRL-1.1