Sigma rule: Potential WinAPI Calls Via PowerShell Scripts

Rule

Title

Potential WinAPI Calls Via PowerShell Scripts

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community

Date

2020-10-06

Modified

2026-04-29

File

rules/windows/powershell/powershell_script/posh_ps_win_api_susp_access.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects usage of WinAPI functions in PowerShell scripts.
It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls.
These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.

Log source

product

windows

category

ps_script

definition

Requirements: Script Block Logging must be enabled

Detection

# Note: Add more suspicious combinations in the form of different selections
selection_injection:
    ScriptBlockText|contains|all:
        - 'VirtualAlloc'
        - 'OpenProcess'
        - 'WriteProcessMemory'
        - 'CreateRemoteThread'
selection_token_steal:
    ScriptBlockText|contains|all:
        - 'OpenProcessToken'
        - 'LookupPrivilegeValue'
        - 'AdjustTokenPrivileges'
selection_duplicate_token:
    ScriptBlockText|contains|all:
        - 'OpenProcessToken'
        - 'DuplicateTokenEx'
        - 'CloseHandle'
selection_process_write_read:
    ScriptBlockText|contains|all:
        - 'WriteProcessMemory'
        - 'VirtualAlloc'
        - 'ReadProcessMemory'
        - 'VirtualFree'
selection_local_shellcode_injection:
    ScriptBlockText|contains|all:
        - 'VirtualAlloc'
        - 'GetDelegateForFunctionPointer'
        - 'Marshal.Copy'
condition: 1 of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.t1059.001
• attack.t1106
• attack.stealth
• attack.t1620

MITRE ATT&CK ids this rule names

• T1059.001
• T1106
• T1620

Related rules

• ba3f5c1b-6272-4119-9dbd-0bc8d21c2702 (similar)

References

• https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
• https://github.com/PowerShellMafia/PowerSploit/blob/1980f403ee78234eae4d93b50890d02f827a099f/CodeExecution/Invoke-Shellcode.ps1
• https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_script/posh_ps_win_api_susp_access.yml