Library / Third-party

pwsh.exe

PowerShell 7 · Microsoft Corporation

Third-partySysmon-confirmedSigma refs: 155

OriginalFilename

pwsh.dll

.NET apphostDiffers from file nameNames a DLLShared with other binaries

Gotchas

PowerShell 7 ships pwsh.exe as a .NET apphost: a small native launcher that loads pwsh.dll. The build copies the DLL's version resource into the launcher, so Sysmon and MDE report pwsh.dll for pwsh.exe processes. Windows PowerShell 5.1 (powershell.exe) reports PowerShell.EXE.

.NET apphost: pwsh.exe is a native launcher that copies its version resource from pwsh.dll, so OriginalFilename names the DLL.
OriginalFilename doesn't match the file name: a rule using OriginalFileName: pwsh.exe never fires.
Same OriginalFilename as pwsh.dll, so OriginalFilename alone can't tell them apart.

Query snippets

logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: '\pwsh.exe'
    - OriginalFileName: 'pwsh.dll'
  condition: selection

process_creation logsource. Sigma string matching is case-insensitive.

| tstats summariesonly=false count values(Processes.original_file_name) as original_file_name
    from datamodel=Endpoint.Processes
    where (Processes.original_file_name="pwsh.dll" OR Processes.process_name="pwsh.exe")
    by Processes.dest Processes.process_name Processes.process_path Processes.process
| rename Processes.* as *

Endpoint.Processes data model. On raw Sysmon events the field is OriginalFileName.

DeviceProcessEvents
| where ProcessVersionInfoOriginalFileName in~ ("pwsh.dll")
    or FileName =~ "pwsh.exe"

Microsoft Defender XDR advanced hunting. in~ and =~ are case-insensitive.

process where event.type == "start" and
  (process.pe.original_file_name in~ ("pwsh.dll") or
   process.name : "pwsh.exe")

ECS process.pe.original_file_name is a keyword field: in~ is case-insensitive, Kibana KQL is not.

['pwsh.dll'].includes(String(OriginalFileName || '').toLowerCase())

Filter expression (JavaScript) for events carrying Sysmon's OriginalFileName field.

Values across builds

OriginalFilename	Builds	Arch	File version	Windows releases	Source	Sysmon
pwsh.dll	1	x64	7.6.9.500		Vendor	✓ 1

OriginalFilename

Builds

Arch

File version

Windows releases

Source

Sysmon

pwsh.dll

x64

7.6.9.500

Vendor

✓ 1

InternalName: pwsh.dll · Product: PowerShell

All 1 parsed builds

SHA256	Version	Arch	OriginalFilename	Windows releases	Signature	Source	Sysmon
2a6769a3330d…	7.6.9.500	x64	pwsh.dll	PowerShell 7		Vendor	✓

SHA256

Version

Arch

OriginalFilename

Windows releases

Signature

Source

Sysmon

2a6769a3330d…

7.6.9.500

x64

pwsh.dll

PowerShell 7

Vendor

✓

Winbindex builds link to the Microsoft symbol server copy that was hashed and parsed.