
title: In-memory PowerShell
author: Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton
date: 2019/11/14
description: Detects loading of essential DLL used by PowerShell, but not by the process
  powershell.exe. Detects meterpreter's "load powershell" extension.
detection:
  SELECTION_1:
    EventID: 7
  SELECTION_2:
    ImageLoaded:
    - '*\System.Management.Automation.Dll'
    - '*\System.Management.Automation.ni.Dll'
  SELECTION_3:
    Image:
    - '*\powershell.exe'
    - '*\powershell_ise.exe'
    - '*\WINDOWS\System32\sdiagnhost.exe'
    - '*\mscorsvw.exe'
    - '*\WINDOWS\System32\RemoteFXvGPUDisablement.exe'
    - '*\sqlps.exe'
    - '*\wsmprovhost.exe'
    - '*\winrshost.exe'
    - '*\syncappvpublishingserver.exe'
    - '*\runscripthelper.exe'
    - '*\ServerManager.exe'
    - '*\Microsoft SQL Server Management Studio *\Common*\IDE\Ssms.exe'
  condition: (SELECTION_1 and SELECTION_2 and  not (SELECTION_3))
enrichment:
- EN_0001_cache_sysmon_event_id_1_info
- EN_0003_enrich_other_sysmon_events_with_event_id_1_data
falsepositives:
- Used by some .NET binaries, minimal on user workstation.
- Used by Microsoft SQL Server Management Studio
id: 092bc4b9-3d1d-43b4-a6b4-8c8acd83522f
level: high
logsource:
  category: image_load
  product: windows
modified: 2021/11/11
references:
- https://adsecurity.org/?p=2921
- https://github.com/p3nt4/PowerShdll
related:
- id: 867613fb-fa60-4497-a017-a82df74a172c
  type: obsoletes
status: experimental
tags:
- attack.t1086
- attack.t1059.001
- attack.execution
ruletype: SIGMA
