PowerShell engine loaded by a process that is not a PowerShell host

Siemphony@siemphonylowT1059.001unverified

AN1252 asks the strategy to cover indirect invocation as well as powershell.exe itself, and the module load is where indirect invocation is actually visible: anything that runs PowerShell without the shipped executable — a C# loader, a signed application hosting a runspace, an implant calling into the automation engine — still has to map System.Management.Automation.dll into its address space, and neither a renamed interpreter nor a bypassed command line changes that. The rule matches that load and subtracts the binaries Microsoft ships as PowerShell hosts, leaving processes that are running PowerShell under some other name. The encoded and hidden arguments MITRE's CommandLinePattern knob points at are deliberately not written here: they belong to the process-creation side and describe obfuscation rather than execution, and the document-parent-spawns- PowerShell chain the ParentProcessName knob names is already the corpus's T1204 rule. Two limits worth stating: the filter is by image path, so a binary renamed to powershell.exe is excluded by the same list that makes the rule usable at all; and Sysmon EventID 7 is off in a bare install while the widely deployed configurations restrict module logging to a named DLL allowlist, so confirm System.Management.Automation.dll is in the running config before reading an empty result as quiet rather than blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0455, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceImageLoadEvents| where ((FolderPath endswith "\\System.Management.Automation.dll" or FolderPath endswith "\\System.Management.Automation.ni.dll") and not ((InitiatingProcessFolderPath endswith "\\powershell.exe" or InitiatingProcessFolderPath endswith "\\powershell_ise.exe" or InitiatingProcessFolderPath endswith "\\pwsh.exe" or InitiatingProcessFolderPath endswith "\\wsmprovhost.exe" or InitiatingProcessFolderPath endswith "\\sdiagnhost.exe" or InitiatingProcessFolderPath endswith "\\ServerManager.exe")))

Splunk · SPL

Run this as a search.

index=* ((ImageLoaded="*\\System.Management.Automation.dll" OR ImageLoaded="*\\System.Management.Automation.ni.dll") AND NOT ((Image="*\\powershell.exe" OR Image="*\\powershell_ise.exe" OR Image="*\\pwsh.exe" OR Image="*\\wsmprovhost.exe" OR Image="*\\sdiagnhost.exe" OR Image="*\\ServerManager.exe")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(file.path) LIKE "*\\\\system.management.automation.dll" OR TO_LOWER(file.path) LIKE "*\\\\system.management.automation.ni.dll") AND NOT ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\powershell_ise.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wsmprovhost.exe" OR TO_LOWER(process.executable) LIKE "*\\\\sdiagnhost.exe" OR TO_LOWER(process.executable) LIKE "*\\\\servermanager.exe")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,image_load,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ImageLoaded" type="pcre2">(?i)(\\System\.Management\.Automation\.dll$|\\System\.Management\.Automation\.ni\.dll$)</field>    <field name="Image" negate="yes" type="pcre2">(?i)(\\powershell\.exe$|\\powershell_ise\.exe$|\\pwsh\.exe$|\\wsmprovhost\.exe$|\\sdiagnhost\.exe$|\\ServerManager\.exe$)</field>    <description>PowerShell engine loaded by a process that is not a PowerShell host</description>    <mitre>      <id>T1059.001</id>    </mitre>  </rule></group>

At a glance

Logsource: image_load / windows
Level: low
Category: suspicious_powershell
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 4c643eb0-5435-49fb-99e6-a018dc836418

ATT&CKT1059.001

T1059.001PowerShell

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsuspicious powershell

suspicious powershellAI draft — unreviewed

01 · What this rule detects

A process that is not a Microsoft-shipped PowerShell host loading the PowerShell engine assembly. Anything running PowerShell without the shipped executable — a C# loader, a signed application hosting a runspace, an implant calling into the automation engine — must still map System.Management.Automation.dll into its address space. Neither a renamed interpreter nor a bypassed command line changes that.

02 · Telemetry you need

category: image_load / product: windows, copied from AN1252's Sysmon EventID 7 entry. EventID 7 is off in a bare Sysmon install, and the widely deployed community configurations restrict module logging to a named DLL allowlist. Confirm System.Management.Automation.dll is in the running config before reading an empty result as quiet rather than blind — module logging is expensive and is the first thing estates trim.

03 · How the logic works

One selection and one filter. selection matches ImageLoaded|endswith on two values: \System.Management.Automation.dll and \System.Management.Automation.ni.dll. The second is the NGEN-compiled native image, and omitting it would lose a large share of loads on older frameworks. filter_shipped_hosts subtracts Image|endswith on six binaries — powershell.exe, powershell_ise.exe, pwsh.exe, wsmprovhost.exe, sdiagnhost.exe, ServerManager.exe — and the condition is selection and not filter_shipped_hosts. What survives is a process running PowerShell under some other name. The reviewer's central finding is about that filter: it matches bare file names, so it excludes an identity it never verified. Drop a loader at C:\Users\Public\powershell.exe and the rule's own exclusion list discards the one event that would have caught it. A second finding: sdiagnhost.exe is one of the few shipped hosts that actually runs attacker-supplied PowerShell, since troubleshooting packs are PowerShell and the msdt chain executes through it. Understand the scope honestly. AN1252 names three observables — encoded or hidden command lines, unusual parents, module loads — and this rule implements only the third, then filters out every shipped interpreter. The common form of the technique, powershell.exe -nop -w hidden -enc …, produces no match here. MITRE's CommandLinePattern knob belongs to a process-creation rule that the corpus does not yet carry under this technique; the ParentProcessName knob is covered by the corpus's T1204 rule. Deploy this as one half of a pair.

04 · Common false positives

Endpoint management and configuration agents that host a runspace in-process rather than launching an executable — Configuration Manager, the Intune management extension, monitoring and backup software. On a managed estate these run on every host on a schedule and are the loudest match by a wide margin. Developer tooling (Visual Studio, VS Code extension hosts, MSBuild tasks, cloud deployment agents) loads the same assembly under its own image name. Exchange, SharePoint and Active Directory administration consoles are PowerShell wrappers and load the engine whenever an admin opens them. EDR products host runspaces for their own remediation scripts. level: low is what that first entry supports.

05 · Detection maturity

tier_1: , and it stays there until it has been run against real data. UNVERIFIED — derived from DET0455 and never executed against a log line.
tier_2: is a week of EventID 7 for this assembly, ranked by loading image path, which produces the allowlist.
tier_3: is pairing it with the process-creation half so the strategy is actually covered.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Anchor the shipped hosts to their install paths rather than their names:
Remove sdiagnhost.exe from the filter and accept troubleshooting packs as a
Baseline your management agents by image path and exclude them explicitly; that
Know the residual gaps: a renamed copy of the assembly misses the endswith

Declared by the author

Endpoint management and configuration agents that host a runspace in-process rather than launching powershell.exe — the Configuration Manager client, the Intune management extension, monitoring agents and backup software all do this. On a managed estate they run on a schedule on every host and are the loudest match by a wide margin, which is what the level reflects.
Developer and administration tooling built on the automation engine: Visual Studio and VS Code extension hosts, MSBuild tasks, cloud deployment agents and SQL Server management components load the same assembly at startup under their own image name.
Server product management surfaces such as the Exchange, SharePoint and Active Directory administration front ends, which are PowerShell wrappers and therefore load the engine every time an administrator opens them.
Antivirus and EDR products that host a runspace to run their own remediation and collection scripts, producing a load under the vendor's service binary on every scan or response action.

Noise check0 of 2 fired

Fires on none of the 2 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 2 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1059.001, evaluated against their image_load events.

Share this rule

/u/siemphony/4c643eb0-5435-49fb-99e6-a018dc836418

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

PowerShell engine loaded by a process that is not a PowerShell host

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it