PowerShell Script Block WinAPI Calls Indicative of Injection or Token Abuse (Windows)

Detects PowerShell ScriptBlocks containing WinAPI function-name combinations consistent with injection and token manipulation.

FreeReviewedSigma · High · v2

Product: windows
Category: ps_script
Author: Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-06
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
- T1106Native API
Persistence
Priv Esc
Defense Evasion
- T1620Reflective Code Loading
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell script block content that references multiple WinAPI functions associated with memory manipulation, remote thread creation, or token handling. Such patterns can reflect attacker attempts to inject code, steal privileges, or operate on other processes while evading traditional file-based inspection. It relies on Windows PowerShell Script Block Logging telemetry containing the matched WinAPI function names within the script block text.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Suspicious PowerShell Reflective Assembly Load With GZip Decompression (via process_creation)

PowerShell Reflective Shellcode Loader via Dynamic API Delegates (via ps_script)

Obfuscated XE Group Reflective Loader via PowerShell Spawned by IIS Worker Process (via process_creation)

Suspicious PowerShell Reflective Assembly Load Invoking VAI Method (via process_creation)

PowerShell Scripts Calling WinAPI DLLs on Windows

Windows PowerShell ScriptBlock WinAPI Function Calls

Windows PowerShell: Base64 Encoded Reflective .NET Assembly Load

Suspicious Script Host Spawning Hidden PowerShell (via process_creation)

Suspicious PowerShell Invoke-Expression with Replace Obfuscation

PowerShell Script Block WinAPI Calls Indicative of Injection or Token Abuse (Windows)

Pivot detection · T1059.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-scriptblock-matching-of-suspicious-winapi-call-patterns-03d83090

title: PowerShell Script Block WinAPI Calls Indicative of Injection or Token Abuse (Windows)
id: 0b6ecf17-fbd1-45ba-a308-21996a351e6e
related:
  - id: ba3f5c1b-6272-4119-9dbd-0bc8d21c2702
    type: similar
  - id: 03d83090-8cba-44a0-b02f-0b756a050306
    type: derived
status: test
description: This rule flags PowerShell script block content that references multiple WinAPI functions associated with memory manipulation, remote thread creation, or token handling. Such patterns can reflect attacker attempts to inject code, steal privileges, or operate on other processes while evading traditional file-based inspection. It relies on Windows PowerShell Script Block Logging telemetry containing the matched WinAPI function names within the script block text.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
  - https://github.com/PowerShellMafia/PowerSploit/blob/1980f403ee78234eae4d93b50890d02f827a099f/CodeExecution/Invoke-Shellcode.ps1
  - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_win_api_susp_access.yml
author: Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-06
modified: 2026-04-29
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1106
  - attack.stealth
  - attack.t1620
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_injection:
    ScriptBlockText|contains|all:
      - VirtualAlloc
      - OpenProcess
      - WriteProcessMemory
      - CreateRemoteThread
  selection_token_steal:
    ScriptBlockText|contains|all:
      - OpenProcessToken
      - LookupPrivilegeValue
      - AdjustTokenPrivileges
  selection_duplicate_token:
    ScriptBlockText|contains|all:
      - OpenProcessToken
      - DuplicateTokenEx
      - CloseHandle
  selection_process_write_read:
    ScriptBlockText|contains|all:
      - WriteProcessMemory
      - VirtualAlloc
      - ReadProcessMemory
      - VirtualFree
  selection_local_shellcode_injection:
    ScriptBlockText|contains|all:
      - VirtualAlloc
      - GetDelegateForFunctionPointer
      - Marshal.Copy
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL