Potential WinAPI Calls Via PowerShell Scripts

About the rule

Rule Type

Standard

Rule Description

Potential WinAPI Calls Via PowerShell Scripts is an instance where PowerShell scripts interact directly with Windows APIs (Win32/WinAPI) to perform operations that are basically outside the scope of basic scripting to bypass traditional security tools.

Severity

Trouble

Rule journey

Attack chain scenario

Initial access (through phishing) → Execution → Privilege Escalation → Command and Control → Impact

Impact

• The PowerShell script is executed in memory, using Add-Type or Reflection.Emit to prepare for WinAPI invocation.
• Using WinAPI calls, the script injects shell-code into a remote process.
• The injected shellcode establishes a HTTPS C2 channel to external remote server
• Data exfiltration

Rule Requirement

Prerequisites

1. Log in to the Group Policy Management Console (GPMC) with domain admin credentials.
2. In the Group Policy Management Editor, go to Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Powershell and enable Turn on Module Logging.
3. In the Options pane, click on Show, and in the Module Name, enter * to record all modules, and press OK.
4. In the Group Policy Management Editor, go to Computer Configuration and Turn on PowerShell Script Block Logging.
5. Create a new registry key "Microsoft-Windows-Powershell/Operational" in the directory "Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\".

Criteria

Detection

Execution Mode

realtime

Log Sources

Windows

MITRE ATT&CK

Execution: Native API (T1106), Execution: Command and Scripting Interpreter - PowerShell (T1059.001)

Security Standards

Enabling this rule will help you meet the security standard's requirements listed below:

PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties

Security administrators ensure to draft and implement strict privilege permission for critical operations of certification and its processes. Leverage IAM and SIEM solutions to ensure access permission and authorizations and regular auditing practices.

DE.CM-01: Networks and network services are monitored to find potentially adverse events.

Security administrators have to continuously monitor all the network and its services in real-time using SIEM tools and identify unusual behavior during connections initiated by WIN32 APIs. Enforce the policies on the web traffic to ensure the network security.

Author

Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community

Future actions

Known False Positives

A instance where Potential WinAPI Calls Via PowerShell Scripts is probably legitimate when it involves authorized administrative, automation, or security tooling operations such as DevOps automation, integration of third party tools, running incident playbooks.

Next Steps

When this rule is triggered, the following measures can be implemented:

1. Identification: Identify the event and check if the flagged incident is new or part of an existing one.
2. Analysis: Analyze the impact and extent of the incident to comprehend the severity of the attack using the Incident Workbench.
3. Response: Respond promptly by initiating an automated workflow to interrupt the network connections and kill or terminate the malicious process.
4. Reconfiguration: Update the network policies and port configurations and continuously monitor traffic trends in the network.

Mitigation