System.Management.Automation.dll
Library on Windows 1 known copy with hashes 2 Sigma rules name it
Is it the real System.Management.Automation.dll?
Installed in
C:\Program Files (x86)\Reference Assemblies\Microsoft\WindowsPowerShell\3.0\Signed byMicrosoft Corporation
1 known copy
Version not recorded · C:\Program Files (x86)\Reference Assemblies\Microsoft\WindowsPowerShell\3.0\System.Management.Automation.dll · signed by Microsoft Corporation
d35f2882d5d8a03b7f1d8fb45eff5d9e90edf51fa17e8341662ae34f76ed0f62From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names System.Management.Automation.dll in 2 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.