Windows Image Load: System.Management.Automation DLL Loaded by Non-PowerShell Process

Alerts when a non-PowerShell executable loads System.Management.Automation.dll on Windows, indicating possible PowerShell execution in another process.

FreeReviewedSigma · Medium · v2

Product: windows
Category: image_load
Author: Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) (SigmaHQ), DRL 1.1
Published: 2019-11-14
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows image load events where a non-PowerShell process loads PowerShell’s core automation DLLs (System.Management.Automation and variants). Loading these PowerShell assemblies outside of pwsh/powershell or related known binaries can indicate attempts to execute PowerShell functionality from an unexpected host process. The detection relies on image-load telemetry that captures the loaded module path, along with process image context to exclude common PowerShell and other permitted loaders.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Malicious Metasploit Stager Delivery via mshta Remote HTA (via process_creation)

Suspicious PowerShell Download of Disguised Payload to ProgramData

Suspicious PowerShell WebClient Download of Executable Payload

Malicious Script Host Spawning PowerShell in Gootloader Chain

Suspicious PsExec Service Launching Encoded PowerShell Payload

Suspicious PowerShell Remote Script Execution via IEX DownloadString

Malicious SharePoint ToolShell Post-Exploitation via Encoded PowerShell (via process_creation)

Suspicious In-Memory PowerShell Execution from Web Server via Automation Assembly (via image_load)

Malicious Qilin Chrome Credential Harvesting Script Execution via IPScanner (via process_creation)

Windows Image Load: System.Management.Automation DLL Loaded by Non-PowerShell Process

Pivot detection · T1059.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-non-powershell-process-loads-powershell-system-management-automation-dll-092bc4b9

title: "Windows Image Load: System.Management.Automation DLL Loaded by Non-PowerShell Process"
id: 659cd9a9-761c-4ede-b9ce-90401d1e1ad7
related:
  - id: 867613fb-fa60-4497-a017-a82df74a172c
    type: obsolete
  - id: fe6e002f-f244-4278-9263-20e4b593827f
    type: obsolete
  - id: 092bc4b9-3d1d-43b4-a6b4-8c8acd83522f
    type: derived
status: test
description: This rule flags Windows image load events where a non-PowerShell process loads PowerShell’s core automation DLLs (System.Management.Automation and variants). Loading these PowerShell assemblies outside of pwsh/powershell or related known binaries can indicate attempts to execute PowerShell functionality from an unexpected host process. The detection relies on image-load telemetry that captures the loaded module path, along with process image context to exclude common PowerShell and other permitted loaders.
references:
  - https://adsecurity.org/?p=2921
  - https://github.com/p3nt4/PowerShdll
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_system_management_automation_susp_load.yml
author: Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2019-11-14
modified: 2026-07-28
tags:
  - attack.t1059.001
  - attack.execution
logsource:
  category: image_load
  product: windows
detection:
  selection:
    - Description: System.Management.Automation
    - OriginalFileName: System.Management.Automation.dll
    - ImageLoaded|endswith:
        - \System.Management.Automation.dll
        - \System.Management.Automation.ni.dll
  filter_main_powershell:
    Image:
      - C:\Program Files\PowerShell\7-preview\pwsh.exe
      - C:\Program Files\PowerShell\7\pwsh.exe
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  filter_main_pwsh_preview:
    Image|contains:
      - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview
      - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview
    Image|endswith: \pwsh.exe
  filter_main_generic:
    Image:
      - C:\Windows\System32\dsac.exe
      - C:\WINDOWS\System32\RemoteFXvGPUDisablement.exe
      - C:\Windows\System32\runscripthelper.exe
      - C:\WINDOWS\System32\sdiagnhost.exe
      - C:\Windows\System32\ServerManager.exe
      - C:\Windows\System32\SyncAppvPublishingServer.exe
      - C:\Windows\System32\winrshost.exe
      - C:\Windows\System32\wsmprovhost.exe
      - C:\Windows\SysWOW64\winrshost.exe
      - C:\Windows\SysWOW64\wsmprovhost.exe
  filter_main_dotnet:
    Image|startswith:
      - C:\Windows\Microsoft.NET\Framework\
      - C:\Windows\Microsoft.NET\FrameworkArm\
      - C:\Windows\Microsoft.NET\FrameworkArm64\
      - C:\Windows\Microsoft.NET\Framework64\
    Image|endswith: \mscorsvw.exe
  filter_optional_gethelp:
    Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_
    Image|endswith: \GetHelp.exe
  filter_optional_sql_server_mgmt:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft SQL Server Management Studio
      - C:\Program Files\Microsoft SQL Server Management Studio
    Image|endswith: \IDE\Ssms.exe
  filter_optional_sql_server_tools:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft SQL Server\
      - C:\Program Files\Microsoft SQL Server\
    Image|endswith: \Tools\Binn\SQLPS.exe
  filter_optional_citrix:
    Image|endswith: \Citrix\ConfigSync\ConfigSyncRun.exe
  filter_optional_vs:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft Visual Studio\
      - C:\Program Files\Microsoft Visual Studio\
  filter_optional_chocolatey:
    Image|startswith: C:\ProgramData\chocolatey\choco.exe
  filter_optional_nextron:
    Image|startswith: C:\Windows\Temp\asgard2-agent\
    Image|endswith:
      - \thor64.exe
      - \thor.exe
  filter_optional_aurora:
    Image: null
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Used by some .NET binaries, minimal on user workstation.
  - Used by Microsoft SQL Server Management Studio
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL