Detectionmediumtest
PowerShell Core DLL Loaded Via Office Application
Detects PowerShell core DLL being loaded by an Office Product
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Nasreddine Bencherchali (Nextron Systems)Created Thu Jun 01bb2ba6fb-95d4-4a25-89fc-30bb736c021awindows
Log Source
WindowsImage Load (DLL)
ProductWindows← raw: windows
CategoryImage Load (DLL)← raw: image_load
Detection Logic
Detection Logic1 selector
detection:
selection:
Image|endswith:
- '\excel.exe'
- '\mspub.exe'
- '\outlook.exe'
- '\onenote.exe'
- '\onenoteim.exe' # Just in case
- '\powerpnt.exe'
- '\winword.exe'
ImageLoaded|contains:
- '\System.Management.Automation.Dll'
- '\System.Management.Automation.ni.Dll'
condition: selectionFalse Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
References
1
Resolving title…
Internal ResearchMITRE ATT&CK
Tactics
Rule Metadata
Rule ID
bb2ba6fb-95d4-4a25-89fc-30bb736c021a
Status
test
Level
medium
Type
Detection
Created
Thu Jun 01
Path
rules/windows/image_load/image_load_office_powershell_dll_load.yml
Raw Tags
attack.defense-evasion