
title: Accessing WinAPI in PowerShell
author: Nikita Nazarov, oscd.community
date: 2020/10/06
description: Detecting use WinAPI Functions in PowerShell
detection:
  SELECTION_1:
    ScriptBlockText:
    - '*WaitForSingleObject*'
    - '*QueueUserApc*'
    - '*RtlCreateUserThread*'
    - '*OpenProcess*'
    - '*VirtualAlloc*'
    - '*VirtualFree*'
    - '*WriteProcessMemory*'
    - '*CreateUserThread*'
    - '*CloseHandle*'
    - '*GetDelegateForFunctionPointer*'
    - '*CreateThread*'
    - '*memcpy*'
    - '*LoadLibrary*'
    - '*GetModuleHandle*'
    - '*GetProcAddress*'
    - '*VirtualProtect*'
    - '*FreeLibrary*'
    - '*ReadProcessMemory*'
    - '*CreateRemoteThread*'
    - '*AdjustTokenPrivileges*'
    - '*WriteByte*'
    - '*WriteInt32*'
    - '*OpenThreadToken*'
    - '*PtrToString*'
    - '*FreeHGlobal*'
    - '*ZeroFreeGlobalAllocUnicode*'
    - '*OpenProcessToken*'
    - '*GetTokenInformation*'
    - '*SetThreadToken*'
    - '*ImpersonateLoggedOnUser*'
    - '*RevertToSelf*'
    - '*GetLogonSessionData*'
    - '*CreateProcessWithToken*'
    - '*DuplicateTokenEx*'
    - '*OpenWindowStation*'
    - '*OpenDesktop*'
    - '*MiniDumpWriteDump*'
    - '*AddSecurityPackage*'
    - '*EnumerateSecurityPackages*'
    - '*GetProcessHandle*'
    - '*DangerousGetHandle*'
    - '*kernel32*'
    - '*Advapi32*'
    - '*msvcrt*'
    - '*ntdll*'
    - '*user32*'
    - '*secur32*'
  condition: SELECTION_1
falsepositives:
- Carbon PowerShell Module (https://github.com/webmd-health-services/Carbon)
id: 03d83090-8cba-44a0-b02f-0b756a050306
level: high
logsource:
  category: ps_script
  definition: Script block logging must be enabled
  product: windows
modified: 2021/10/16
references:
- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
status: experimental
tags:
- attack.execution
- attack.t1059.001
- attack.t1106
ruletype: SIGMA
