PowerShell Script Block WinAPI Calls Indicative of Injection or Token Abuse (Windows)
Detects PowerShell ScriptBlocks containing WinAPI function-name combinations consistent with injection and token manipulation.
- Product
- windows
- Category
- ps_script
- Author
- Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-06
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script block content that references multiple WinAPI functions associated with memory manipulation, remote thread creation, or token handling. Such patterns can reflect attacker attempts to inject code, steal privileges, or operate on other processes while evading traditional file-based inspection. It relies on Windows PowerShell Script Block Logging telemetry containing the matched WinAPI function names within the script block text.
Reporting behind it
- speakerdeck.comhttps://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
- github.comhttps://github.com/PowerShellMafia/PowerSploit/blob/1980f403ee78234eae4d93b50890d02f827a099f/CodeExecution/Invoke-Shellcode.ps1
- thedfirreport.comhttps://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_win_api_susp_access.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Script Block WinAPI Calls Indicative of Injection or Token Abuse (Windows)
id: 0b6ecf17-fbd1-45ba-a308-21996a351e6e
related:
- id: ba3f5c1b-6272-4119-9dbd-0bc8d21c2702
type: similar
- id: 03d83090-8cba-44a0-b02f-0b756a050306
type: derived
status: test
description: This rule flags PowerShell script block content that references multiple WinAPI functions associated with memory manipulation, remote thread creation, or token handling. Such patterns can reflect attacker attempts to inject code, steal privileges, or operate on other processes while evading traditional file-based inspection. It relies on Windows PowerShell Script Block Logging telemetry containing the matched WinAPI function names within the script block text.
references:
- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
- https://github.com/PowerShellMafia/PowerSploit/blob/1980f403ee78234eae4d93b50890d02f827a099f/CodeExecution/Invoke-Shellcode.ps1
- https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_win_api_susp_access.yml
author: Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-06
modified: 2026-04-29
tags:
- attack.execution
- attack.t1059.001
- attack.t1106
- attack.stealth
- attack.t1620
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_injection:
ScriptBlockText|contains|all:
- VirtualAlloc
- OpenProcess
- WriteProcessMemory
- CreateRemoteThread
selection_token_steal:
ScriptBlockText|contains|all:
- OpenProcessToken
- LookupPrivilegeValue
- AdjustTokenPrivileges
selection_duplicate_token:
ScriptBlockText|contains|all:
- OpenProcessToken
- DuplicateTokenEx
- CloseHandle
selection_process_write_read:
ScriptBlockText|contains|all:
- WriteProcessMemory
- VirtualAlloc
- ReadProcessMemory
- VirtualFree
selection_local_shellcode_injection:
ScriptBlockText|contains|all:
- VirtualAlloc
- GetDelegateForFunctionPointer
- Marshal.Copy
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1