huntrule

PowerShell scripts calling WinAPI DLLs on Windows

Detects PowerShell script blocks that reference WinAPI-related Windows DLLs such as kernel32.dll and ntdll.dll.

FreeUnreviewedSigmamediumv1
title: PowerShell scripts calling WinAPI DLLs on Windows
id: 05dcf360-2100-40cf-862e-5d06d39e86c0
related:
  - id: ba3f5c1b-6272-4119-9dbd-0bc8d21c2702
    type: similar
  - id: 03d83090-8cba-44a0-b02f-0b756a050306
    type: similar
  - id: 9f22ccd5-a435-453b-af96-bf99cbb594d4
    type: similar
  - id: 19d65a1c-8540-4140-8062-8eb00db0bba5
    type: derived
status: test
description: This rule flags PowerShell script block content that includes references to common Windows system DLLs used for WinAPI calls, including Advapi32.dll, kernel32.dll, KernelBase.dll, ntdll.dll, secur32.dll, and user32.dll. Attackers can embed these DLL names in script logic to invoke native functionality and potentially bypass detections focused on higher-level PowerShell activity. It relies on script block logging telemetry that captures the text of executed PowerShell script blocks.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_win_api_functions_access.yml
author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-21
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1106
  - detection.threat-hunting
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - Advapi32.dll
      - kernel32.dll
      - KernelBase.dll
      - ntdll.dll
      - secur32.dll
      - user32.dll
  condition: selection
falsepositives:
  - Carbon PowerShell Module (https://github.com/webmd-health-services/Carbon)
  - Chocolatey scripts
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell script block content that includes references to common Windows system DLLs used for WinAPI calls, including Advapi32.dll, kernel32.dll, KernelBase.dll, ntdll.dll, secur32.dll, and user32.dll. Attackers can embed these DLL names in script logic to invoke native functionality and potentially bypass detections focused on higher-level PowerShell activity. It relies on script block logging telemetry that captures the text of executed PowerShell script blocks.

Known false positives

  • Carbon PowerShell Module (https://github.com/webmd-health-services/Carbon)
  • Chocolatey scripts

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.