WinAPI Function Calls Via PowerShell Scripts
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects calls to WinAPI functions from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "PowerShell Script Block Logged" AND SCRIPTEXECUTED contains "AddSecurityPackage,AdjustTokenPrivileges,CloseHandle,CreateProcessWithToken,CreateRemoteThread,CreateThread,CreateUserThread,DangerousGetHandle,DuplicateTokenEx,EnumerateSecurityPackages,FreeLibrary,GetDelegateForFunctionPointer,GetLogonSessionData,GetModuleHandle,GetProcAddress,GetProcessHandle,GetTokenInformation,ImpersonateLoggedOnUser,LoadLibrary" OR SCRIPTEXECUTED contains "memcpy,MiniDumpWriteDump,OpenDesktop,OpenProcess,OpenProcessToken,OpenThreadToken,OpenWindowStation,QueueUserApc,ReadProcessMemory,RevertToSelf,RtlCreateUserThread,SetThreadToken,VirtualAlloc,VirtualFree,VirtualProtect,WaitForSingleObject,WriteInt32,WriteProcessMemory,ZeroFreeGlobalAllocUnicode" select Action1.HOSTNAME,Action1.MESSAGE,Action1.SCRIPTEXECUTED
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
