Binary loaded PowerShell automation library - Possible unmanaged Powershell execution by suspicious process

Description

No license declared

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 92151 Binary loaded PowerShell automation library - Possible unmanaged Powershell execution by suspicious process anchor level 12
   field win.eventdata.originalFileName="(?i)System.Management.Automation.dll" AND field win.eventdata.image="(?i)[c-z]\:\\\\Windows\\\\Microsoft.NET\\.+\\csc\\.exe$" AND field win.eventdata.image="(?i)(devenv|node|SSMS|VSLauncher)\.exe$" AND field win.eventdata.image="(?i)(sdiagnhost|SmartAudio3)\.exe$" AND field win.eventdata.image="(?i)(pwsh\.dll|powershell(_ise)?\.exe)$"
2. 900107 Binary loaded PowerShell automation library - Possible unmanaged Powershell execution by suspicious process exclusion level 10 this rule
   Matches no fields of its own.

Rule dependencies

Depends on

• composes · Wazuh if_sid 92151
  • Binary loaded PowerShell automation library - Possible unmanaged Powershell execution by suspicious process