Windows PowerShell ScriptBlock Matching of Suspicious WinAPI Call Patterns

Detects PowerShell ScriptBlocks containing WinAPI function-name combinations consistent with injection and token manipulation.

FreeUnreviewedSigmahighv1

windows-powershell-scriptblock-matching-of-suspicious-winapi-call-patterns-03d83090

title: Windows PowerShell ScriptBlock Matching of Suspicious WinAPI Call Patterns
id: 0b6ecf17-fbd1-45ba-a308-21996a351e6e
related:
  - id: ba3f5c1b-6272-4119-9dbd-0bc8d21c2702
    type: similar
  - id: 03d83090-8cba-44a0-b02f-0b756a050306
    type: derived
status: test
description: This rule flags PowerShell script content that includes specific combinations of Windows API function names associated with in-memory process manipulation and credential/token handling. Attackers may use these WinAPI calls from PowerShell to execute actions without dropping obvious binaries, helping evade file-based detections. It relies on Script Block Logging telemetry where the PowerShell ScriptBlockText can be matched for required function-name sets.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
  - https://github.com/PowerShellMafia/PowerSploit/blob/1980f403ee78234eae4d93b50890d02f827a099f/CodeExecution/Invoke-Shellcode.ps1
  - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_win_api_susp_access.yml
author: Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-06
modified: 2026-04-29
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1106
  - attack.stealth
  - attack.t1620
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_injection:
    ScriptBlockText|contains|all:
      - VirtualAlloc
      - OpenProcess
      - WriteProcessMemory
      - CreateRemoteThread
  selection_token_steal:
    ScriptBlockText|contains|all:
      - OpenProcessToken
      - LookupPrivilegeValue
      - AdjustTokenPrivileges
  selection_duplicate_token:
    ScriptBlockText|contains|all:
      - OpenProcessToken
      - DuplicateTokenEx
      - CloseHandle
  selection_process_write_read:
    ScriptBlockText|contains|all:
      - WriteProcessMemory
      - VirtualAlloc
      - ReadProcessMemory
      - VirtualFree
  selection_local_shellcode_injection:
    ScriptBlockText|contains|all:
      - VirtualAlloc
      - GetDelegateForFunctionPointer
      - Marshal.Copy
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags PowerShell script content that includes specific combinations of Windows API function names associated with in-memory process manipulation and credential/token handling. Attackers may use these WinAPI calls from PowerShell to execute actions without dropping obvious binaries, helping evade file-based detections. It relies on Script Block Logging telemetry where the PowerShell ScriptBlockText can be matched for required function-name sets.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.