PowerShell Core DLL Loaded By Non-PowerShell Process

SigmaHQ Detections@sigmaHQ

•updated Oct 9, 2025•0•25

Detects when essential PowerShell DLLs, specifically 'System.Management.Automation.dll', are loaded by processes that are not legitimate PowerShell executables. This behavior can indicate malicious activity, such as an attacker using techniques like meterpreter's 'load powershell' extension or PowerShdll to execute PowerShell commands in a stealthy manner without directly invoking powershell.exe.