Query: write Sigma for Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter'
Matching passage: Sigma rule: Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter'. Logsource: windows / image_load. Rule: title: PowerShell Core DLL Loaded By Non PowerShell Process id: 092bc4b9-3d1d-43b4-a6b4-8c8acd83522f related: - id: 867613fb-fa60-4497-a017-a82df74a172c type: obsolete - id: fe6e002f-f244-4278-9263-20e4b593827f type: obsolete status: test description: 'Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter''s "load powershell" extension. ' references: - https://adsecurity.org/?p=2921 - https://github.com/p3nt4/PowerShdll author: Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2019-11-14 modified: 2026-07-28 tags: - attack.t1059.001 - attack.execution logsource: category: image_load product: windows detection: selection: - Description: System.Management.Automation - OriginalFileName: System.Management.Automation.dll - ImageLoaded|endswith: - \System.Management.Automation.dll - \System.Management.Automation.ni.dll filter_main_powershell: Image: - C:\Program Files\PowerShell\7-preview\pwsh.exe - C:\Program Files\PowerShell\7\pwsh.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe filter_main_pwsh_preview: Image|contains: - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview Image|endswith: \pwsh.exe filter_main_generic: Image: - C:\Windows\System32\dsac.exe - C:\WINDOWS\System32\RemoteFXvGPUDisablement.exe - C:\Windows\System32\runscripthelper.exe - C:\WINDOWS\System32\sdiagnhost.exe - C:\Windows\System32\ServerManager.exe - C:\Windows\System32\SyncAppvPublishingServer.exe - C:\Windows\System32\winrshost.exe - C:\Windows\System32\wsmprovhost.exe - C:\Windows\SysWOW64\winrshost.exe - C:\Windows\SysWOW64\wsmprovhost.exe filter_main_dotnet: Image|startswith: - C:\Windows\Microsoft.NET\Framework\ - C:\Windows\Microsoft.NET\FrameworkArm\ - C:\Windows\Microsoft.NET\FrameworkArm64\ - C:\Windows\Microsoft.NET\Framework64\ Image|endswith: \mscorsvw.exe filter_optional_gethelp: Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_ Image|endswith: \GetHelp.exe filter_optional_sql_server_mgmt: Image|startswith: - C:\Program Files (x86)\Microsoft SQL Server Management Studio - C:\Program Files\Microsoft SQL Server Management Studio Image|endswith: \IDE\
Near-miss passage: Sigma rule: Detects suspicious Powershell code that execute COM Objects. Logsource: windows / ps_script. Rule: title: Suspicious GetTypeFromCLSID ShellExecute id: 8bc063d5-3a3a-4f01-a140-bc15e55e8437 status: test description: Detects suspicious Powershell code that execute COM Objects references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.015/T1546.015.md#atomic-test-2---powershell-execute-com-object author: frack113 date: 2022-04-02 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - ::GetTypeFromCLSID( - .ShellExecute( condition: selection falsepositives: - Legitimate PowerShell scripts level: medium