Potential WinAPI Calls Via PowerShell Scripts

calendar Jul 1, 2026 · attack.execution attack.t1059.001 attack.t1106 attack.stealth attack.t1620  ·
Share on: linkedin copy

Detects usage of WinAPI functions in PowerShell scripts. It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls. These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.

Sigma rule (View on GitHub)

 1title: Potential WinAPI Calls Via PowerShell Scripts
 2id: 03d83090-8cba-44a0-b02f-0b756a050306
 3related:
 4    - id: ba3f5c1b-6272-4119-9dbd-0bc8d21c2702
 5      type: similar
 6status: test
 7description: |
 8    Detects usage of WinAPI functions in PowerShell scripts.
 9    It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls.
10    These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.    
11references:
12    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
13    - https://github.com/PowerShellMafia/PowerSploit/blob/1980f403ee78234eae4d93b50890d02f827a099f/CodeExecution/Invoke-Shellcode.ps1
14    - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
15author: Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community
16date: 2020-10-06
17modified: 2026-04-29
18tags:
19    - attack.execution
20    - attack.t1059.001
21    - attack.t1106
22    - attack.stealth
23    - attack.t1620
24logsource:
25    product: windows
26    category: ps_script
27    definition: 'Requirements: Script Block Logging must be enabled'
28detection:
29    # Note: Add more suspicious combinations in the form of different selections
30    selection_injection:
31        ScriptBlockText|contains|all:
32            - 'VirtualAlloc'
33            - 'OpenProcess'
34            - 'WriteProcessMemory'
35            - 'CreateRemoteThread'
36    selection_token_steal:
37        ScriptBlockText|contains|all:
38            - 'OpenProcessToken'
39            - 'LookupPrivilegeValue'
40            - 'AdjustTokenPrivileges'
41    selection_duplicate_token:
42        ScriptBlockText|contains|all:
43            - 'OpenProcessToken'
44            - 'DuplicateTokenEx'
45            - 'CloseHandle'
46    selection_process_write_read:
47        ScriptBlockText|contains|all:
48            - 'WriteProcessMemory'
49            - 'VirtualAlloc'
50            - 'ReadProcessMemory'
51            - 'VirtualFree'
52    selection_local_shellcode_injection:
53        ScriptBlockText|contains|all:
54            - 'VirtualAlloc'
55            - 'GetDelegateForFunctionPointer'
56            - 'Marshal.Copy'
57    condition: 1 of selection_*
58falsepositives:
59    - Unknown
60level: high

References

Related rules

to-top