PowerShell Core DLL Loaded By Non PowerShell Process
This threat brief details a detection for the suspicious loading of PowerShell Core DLLs by non-PowerShell processes, a technique often employed by attackers to execute PowerShell code stealthily and evade security monitoring.
This brief focuses on the detection of the System.Management.Automation.dll or its native image counterpart (System.Management.Automation.ni.dll) being loaded into memory by a process that is not a standard PowerShell executable (e.g., powershell.exe, pwsh.exe). This technique, often referred to as "PowerShell without PowerShell.exe" or "reflective PowerShell loading," allows attackers to leverage PowerShell functionalities from an unexpected process context, potentially bypassing traditional endpoint detection and response (EDR) solutions that primarily monitor powershell.exe or pwsh.exe directly. Malicious actors use this method to execute scripts, establish persistence, elevate privileges, or perform data exfiltration in a stealthier manner. The detection specifically identifies behavior similar to the load powershell extension in Meterpreter, indicating a sophisticated attempt at code execution and evasion.
Impact
Successful exploitation of this technique by an attacker allows for arbitrary PowerShell code execution within the context of an unprivileged process. This can lead to a variety of severe consequences, including system compromise, lateral movement within the network, privilege escalation, and data exfiltration. Because this method bypasses common powershell.exe monitoring, it significantly increases an attacker's ability to remain undetected while performing malicious activities, leading to prolonged dwell times and more extensive damage to an organization's systems and data.
Recommendation
- Enable
ImageLoadevent logging in your endpoint detection solutions (e.g., Sysmon Event ID 7) to collect the necessary telemetry for the included Sigma rule. - Deploy the Sigma rule "PowerShell Core DLL Loaded By Non PowerShell Process" to your SIEM and tune the filters for your environment to minimize false positives related to legitimate applications.
- Investigate any alerts generated by the "PowerShell Core DLL Loaded By Non PowerShell Process" rule, focusing on the parent process and its command line arguments for signs of suspicious activity.
Detection coverage 1
PowerShell Core DLL Loaded By Non PowerShell Process
mediumDetects the loading of essential PowerShell DLLs by processes that are not standard PowerShell executables, a technique used for stealthy PowerShell code execution.
Detection queries are available on the platform. Get full rules →