PowerShell Core DLL Loaded Via Office Application

Severity: medium
Author: Nasreddine Bencherchali (Nextron Systems)
Source: upstream

Detects PowerShell core DLL being loaded by an Office Product

Event coverage

Provider	Event ID	Title
Sysmon	7	Image loaded

Stages and Predicates

Stage 1: `selection`

or:
Image|endswith: '\excel.exe'
Image|endswith: '\mspub.exe'
Image|endswith: '\onenote.exe'
Image|endswith: '\onenoteim.exe'
Image|endswith: '\outlook.exe'
Image|endswith: '\powerpnt.exe'
Image|endswith: '\winword.exe'
or:
ImageLoaded|contains: '\System.Management.Automation.Dll'
ImageLoaded|contains: '\System.Management.Automation.ni.Dll'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Image`	ends_with	`\excel.exe` corpus 16 (sigma 16) `\mspub.exe` corpus 7 (sigma 7) `\onenote.exe` corpus 6 (sigma 6) `\onenoteim.exe` corpus 6 (sigma 6) `\outlook.exe` corpus 16 (sigma 16) `\powerpnt.exe` corpus 13 (sigma 13) `\winword.exe` corpus 17 (sigma 17)
`ImageLoaded`	match	`\System.Management.Automation.Dll` `\System.Management.Automation.ni.Dll`

PowerShell Core DLL Loaded Via Office Application

Event coverage

Stages and Predicates

Stage 1: selection

Indicators

Stage 1: `selection`