Query: alert when Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter'
Matching passage: Sigma rule: Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter'. Logsource: windows / image_load. Rule: title: PowerShell Core DLL Loaded By Non PowerShell Process id: 092bc4b9-3d1d-43b4-a6b4-8c8acd83522f related: - id: 867613fb-fa60-4497-a017-a82df74a172c type: obsolete - id: fe6e002f-f244-4278-9263-20e4b593827f type: obsolete status: test description: 'Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter''s "load powershell" extension. ' references: - https://adsecurity.org/?p=2921 - https://github.com/p3nt4/PowerShdll author: Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2019-11-14 modified: 2026-07-28 tags: - attack.t1059.001 - attack.execution logsource: category: image_load product: windows detection: selection: - Description: System.Management.Automation - OriginalFileName: System.Management.Automation.dll - ImageLoaded|endswith: - \System.Management.Automation.dll - \System.Management.Automation.ni.dll filter_main_powershell: Image: - C:\Program Files\PowerShell\7-preview\pwsh.exe - C:\Program Files\PowerShell\7\pwsh.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe filter_main_pwsh_preview: Image|contains: - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview Image|endswith: \pwsh.exe filter_main_generic: Image: - C:\Windows\System32\dsac.exe - C:\WINDOWS\System32\RemoteFXvGPUDisablement.exe - C:\Windows\System32\runscripthelper.exe - C:\WINDOWS\System32\sdiagnhost.exe - C:\Windows\System32\ServerManager.exe - C:\Windows\System32\SyncAppvPublishingServer.exe - C:\Windows\System32\winrshost.exe - C:\Windows\System32\wsmprovhost.exe - C:\Windows\SysWOW64\winrshost.exe - C:\Windows\SysWOW64\wsmprovhost.exe filter_main_dotnet: Image|startswith: - C:\Windows\Microsoft.NET\Framework\ - C:\Windows\Microsoft.NET\FrameworkArm\ - C:\Windows\Microsoft.NET\FrameworkArm64\ - C:\Windows\Microsoft.NET\Framework64\ Image|endswith: \mscorsvw.exe filter_optional_gethelp: Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_ Image|endswith: \GetHelp.exe filter_optional_sql_server_mgmt: Image|startswith: - C:\Program Files (x86)\Microsoft SQL Server Management Studio - C:\Program Files\Microsoft SQL Server Management Studio Image|endswith: \IDE\
Near-miss passage: Sigma rule: Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping.. Logsource: windows / file_event. Rule: title: LSASS Process Dump Artefact In CrashDumps Folder id: 6902955a-01b7-432c-b32a-6f5f81d8f625 status: test description: Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process. references: - https://github.com/deepinstinct/Lsass-Shtinkering - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf author: '@pbssubhash' date: 2022-12-08 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: file_event detection: selection: TargetFilename|startswith: C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\ TargetFilename|contains: lsass.exe. TargetFilename|endswith: .dmp condition: selection falsepositives: - Rare legitimate dump of the process by the operating system due to a crash of lsass level: high