PowerShell Core DLL Loaded By Non PowerShell Process

{
  "selection": [
    {
      "Description": "System.Management.Automation"
    },
    {
      "OriginalFileName": "System.Management.Automation.dll"
    },
    {
      "ImageLoaded
| endswith": [
        "\\System.Management.Automation.dll",
        "\\System.Management.Automation.ni.dll"
      ]
    }
  ],
  "filter_main_powershell": {
    "Image": [
      "C:\\Program Files\\PowerShell\\7-preview\\pwsh.exe",
      "C:\\Program Files\\PowerShell\\7\\pwsh.exe",
      "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe",
      "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
      "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell_ise.exe",
      "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"
    ]
  },
  "filter_main_pwsh_preview": {
    "Image
| contains": [
      "C:\\Program Files\\WindowsApps\\Microsoft.PowerShellPreview",
      "\\AppData\\Local\\Microsoft\\WindowsApps\\Microsoft.PowerShellPreview"
    ],
    "Image
| endswith": "\\pwsh.exe"
  },
  "filter_main_generic": {
    "Image": [
      "C:\\Windows\\System32\\dsac.exe",
      "C:\\WINDOWS\\System32\\RemoteFXvGPUDisablement.exe",
      "C:\\Windows\\System32\\runscripthelper.exe",
      "C:\\WINDOWS\\System32\\sdiagnhost.exe",
      "C:\\Windows\\System32\\ServerManager.exe",
      "C:\\Windows\\System32\\SyncAppvPublishingServer.exe",
      "C:\\Windows\\System32\\winrshost.exe",
      "C:\\Windows\\System32\\wsmprovhost.exe",
      "C:\\Windows\\SysWOW64\\winrshost.exe",
      "C:\\Windows\\SysWOW64\\wsmprovhost.exe"
    ]
  },
  "filter_main_dotnet": {
    "Image
| startswith": [
      "C:\\Windows\\Microsoft.NET\\Framework\\",
      "C:\\Windows\\Microsoft.NET\\FrameworkArm\\",
      "C:\\Windows\\Microsoft.NET\\FrameworkArm64\\",
      "C:\\Windows\\Microsoft.NET\\Framework64\\"
    ],
    "Image
| endswith": "\\mscorsvw.exe"
  },
  "filter_optional_gethelp": {
    "Image
| startswith": "C:\\Program Files\\WindowsApps\\Microsoft.GetHelp_",
    "Image
| endswith": "\\GetHelp.exe"
  },
  "filter_optional_sql_server_mgmt": {
    "Image
| startswith": [
      "C:\\Program Files (x86)\\Microsoft SQL Server Management Studio",
      "C:\\Program Files\\Microsoft SQL Server Management Studio"
    ],
    "Image
| endswith": "\\IDE\\Ssms.exe"
  },
  "filter_optional_sql_server_tools": {
    "Image
| startswith": [
      "C:\\Program Files (x86)\\Microsoft SQL Server\\",
      "C:\\Program Files\\Microsoft SQL Server\\"
    ],
    "Image
| endswith": "\\Tools\\Binn\\SQLPS.exe"
  },
  "filter_optional_citrix": {
    "Image
| endswith": "\\Citrix\\ConfigSync\\ConfigSyncRun.exe"
  },
  "filter_optional_vs": {
    "Image
| startswith": [
      "C:\\Program Files (x86)\\Microsoft Visual Studio\\",
      "C:\\Program Files\\Microsoft Visual Studio\\"
    ]
  },
  "filter_optional_chocolatey": {
    "Image
| startswith": "C:\\ProgramData\\chocolatey\\choco.exe"
  },
  "filter_optional_nextron": {
    "Image
| startswith": "C:\\Windows\\Temp\\asgard2-agent\\",
    "Image
| endswith": [
      "\\thor64.exe",
      "\\thor.exe"
    ]
  },
  "filter_optional_aurora": {
    "Image": null
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

False Positives

• ⚠ Used by some .NET binaries, minimal on user workstation.
• ⚠ Used by Microsoft SQL Server Management Studio