{"id":"ba3f5c1b-6272-4119-9dbd-0bc8d21c2702","title":"Potential WinAPI Calls Via CommandLine","description":"Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-09-06","modified":"2025-03-06","tags":["attack.execution","attack.t1106"],"technique_ids":["T1106"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Some legitimate action or applications may use these functions. Investigate further to determine the legitimacy of the activity."],"references":["https://twitter.com/m417z/status/1566674631788007425"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_inline_win_api_access.yml","source_sha256":"5452717da6a6e3856b38e0146fca6e4398c27e16d19e1cdd54e59b3bb0f085fa","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_inline_win_api_access.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential WinAPI Calls Via CommandLine\nid: ba3f5c1b-6272-4119-9dbd-0bc8d21c2702\nrelated:\n    - id: 03d83090-8cba-44a0-b02f-0b756a050306\n      type: derived\nstatus: test\ndescription: Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec\nreferences:\n    - https://twitter.com/m417z/status/1566674631788007425\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-09-06\nmodified: 2025-03-06\ntags:\n    - attack.execution\n    - attack.t1106\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains:\n            - 'AddSecurityPackage'\n            - 'AdjustTokenPrivileges'\n            - 'Advapi32'\n            - 'CloseHandle'\n            - 'CreateProcessWithToken'\n            - 'CreatePseudoConsole'\n            - 'CreateRemoteThread'\n            - 'CreateThread'\n            - 'CreateUserThread'\n            - 'DangerousGetHandle'\n            - 'DuplicateTokenEx'\n            - 'EnumerateSecurityPackages'\n            - 'FreeHGlobal'\n            - 'FreeLibrary'\n            - 'GetDelegateForFunctionPointer'\n            - 'GetLogonSessionData'\n            - 'GetModuleHandle'\n            - 'GetProcAddress'\n            - 'GetProcessHandle'\n            - 'GetTokenInformation'\n            - 'ImpersonateLoggedOnUser'\n            - 'kernel32'\n            - 'LoadLibrary'\n            - 'memcpy'\n            - 'MiniDumpWriteDump'\n            # - 'msvcrt'\n            - 'ntdll'\n            - 'OpenDesktop'\n            - 'OpenProcess'\n            - 'OpenProcessToken'\n            - 'OpenThreadToken'\n            - 'OpenWindowStation'\n            - 'PtrToString'\n            - 'QueueUserApc'\n            - 'ReadProcessMemory'\n            - 'RevertToSelf'\n            - 'RtlCreateUserThread'\n            - 'secur32'\n            - 'SetThreadToken'\n            # - 'user32'\n            - 'VirtualAlloc'\n            - 'VirtualFree'\n            - 'VirtualProtect'\n            - 'WaitForSingleObject'\n            - 'WriteInt32'\n            - 'WriteProcessMemory'\n            - 'ZeroFreeGlobalAllocUnicode'\n    filter_optional_mpcmdrun:\n        Image|endswith: '\\MpCmdRun.exe'\n        CommandLine|contains: 'GetLoadLibraryWAddress32'\n    filter_optional_compatTelRunner:\n        ParentImage|endswith: '\\CompatTelRunner.exe'\n        CommandLine|contains:\n            - 'FreeHGlobal'\n            - 'PtrToString'\n            - 'kernel32'\n            - 'CloseHandle'\n    condition: selection and not 1 of filter_optional_*\nfalsepositives:\n    - Some legitimate action or applications may use these functions. Investigate further to determine the legitimacy of the activity.\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1106","id":"T1106","name":"Native API","page":"techniques/enterprise/T1106/"}],"data_path":"data/detection-rules/ba3f5c1b-6272-4119-9dbd-0bc8d21c2702.json","kind":"sigma"}