PowerShell engine loaded by a process that is not a PowerShell host

1title: PowerShell engine loaded by a process that is not a PowerShell host2id: 4c643eb0-5435-49fb-99e6-a018dc8364183status: experimental4description: |5  AN1252 asks the strategy to cover indirect invocation as well as powershell.exe6  itself, and the module load is where indirect invocation is actually visible:7  anything that runs PowerShell without the shipped executable — a C# loader, a8  signed application hosting a runspace, an implant calling into the automation9  engine — still has to map System.Management.Automation.dll into its address10  space, and neither a renamed interpreter nor a bypassed command line changes11  that. The rule matches that load and subtracts the binaries Microsoft ships as12  PowerShell hosts, leaving processes that are running PowerShell under some other13  name. The encoded and hidden arguments MITRE's CommandLinePattern knob points at14  are deliberately not written here: they belong to the process-creation side and15  describe obfuscation rather than execution, and the document-parent-spawns-16  PowerShell chain the ParentProcessName knob names is already the corpus's T120417  rule. Two limits worth stating: the filter is by image path, so a binary renamed18  to powershell.exe is excluded by the same list that makes the rule usable at19  all; and Sysmon EventID 7 is off in a bare install while the widely deployed20  configurations restrict module logging to a named DLL allowlist, so confirm21  System.Management.Automation.dll is in the running config before reading an22  empty result as quiet rather than blind.23  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0455, not hand-written and not tested by its author. Any lab result is on this rule's own page.24references:25  - https://attack.mitre.org/techniques/T1059/00126  - https://attack.mitre.org/detectionstrategies/DET045527author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)28date: 2026-08-1629tags:30  - attack.execution31  - attack.t1059.00132logsource:33  category: image_load34  product: windows35detection:36  selection:37    ImageLoaded|endswith:38      - '\System.Management.Automation.dll'39      - '\System.Management.Automation.ni.dll'40  filter_shipped_hosts:41    Image|endswith:42      - '\powershell.exe'43      - '\powershell_ise.exe'44      - '\pwsh.exe'45      - '\wsmprovhost.exe'46      - '\sdiagnhost.exe'47      - '\ServerManager.exe'48  condition: selection and not filter_shipped_hosts49falsepositives:50  - "Endpoint management and configuration agents that host a runspace in-process rather than launching powershell.exe — the Configuration Manager client, the Intune management extension, monitoring agents and backup software all do this. On a managed estate they run on a schedule on every host and are the loudest match by a wide margin, which is what the level reflects."51  - "Developer and administration tooling built on the automation engine: Visual Studio and VS Code extension hosts, MSBuild tasks, cloud deployment agents and SQL Server management components load the same assembly at startup under their own image name."52  - "Server product management surfaces such as the Exchange, SharePoint and Active Directory administration front ends, which are PowerShell wrappers and therefore load the engine every time an administrator opens them."53  - "Antivirus and EDR products that host a runspace to run their own remediation and collection scripts, producing a load under the vendor's service binary on every scan or response action."54level: low