{"id":"03d83090-8cba-44a0-b02f-0b756a050306","title":"Potential WinAPI Calls Via PowerShell Scripts","description":"Detects use of WinAPI functions in PowerShell scripts","author":"Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-06","modified":"2023-06-20","tags":["attack.execution","attack.t1059.001","attack.t1106"],"technique_ids":["T1059.001","T1106"],"logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"falsepositives":["Unknown"],"references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_win_api_susp_access.yml","source_sha256":"c0081bb2293f19f6e0ae23df988780296bc1edf1a2203390b43eb85ecf262dd7","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_win_api_susp_access.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential WinAPI Calls Via PowerShell Scripts\nid: 03d83090-8cba-44a0-b02f-0b756a050306\nrelated:\n    - id: ba3f5c1b-6272-4119-9dbd-0bc8d21c2702\n      type: similar\nstatus: test\ndescription: Detects use of WinAPI functions in PowerShell scripts\nreferences:\n    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse\nauthor: Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community\ndate: 2020-10-06\nmodified: 2023-06-20\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.t1106\nlogsource:\n    product: windows\n    category: ps_script\n    definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n    # Note: Add more suspicious combinations in the form of different selections\n    selection_injection:\n        ScriptBlockText|contains|all:\n            - 'VirtualAlloc'\n            - 'OpenProcess'\n            - 'WriteProcessMemory'\n            - 'CreateRemoteThread'\n    selection_token_steal:\n        ScriptBlockText|contains|all:\n            - 'OpenProcessToken'\n            - 'LookupPrivilegeValue'\n            - 'AdjustTokenPrivileges'\n    selection_duplicate_token:\n        ScriptBlockText|contains|all:\n            - 'OpenProcessToken'\n            - 'DuplicateTokenEx'\n            - 'CloseHandle'\n    selection_process_write_read:\n        ScriptBlockText|contains|all:\n            - 'WriteProcessMemory'\n            - 'VirtualAlloc'\n            - 'ReadProcessMemory'\n            - 'VirtualFree'\n    condition: 1 of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"},{"key":"enterprise/T1106","id":"T1106","name":"Native API","page":"techniques/enterprise/T1106/"}],"data_path":"data/detection-rules/03d83090-8cba-44a0-b02f-0b756a050306.json","kind":"sigma"}