Windows Process Creation: WinAPI Function Names in Command-Line

Alerts on Windows processes whose command lines reference WinAPI functions/modules commonly used for dynamic invocation and memory/process manipulation.

FreeUnreviewedSigmahighv1

windows-process-creation-winapi-function-names-in-command-line-ba3f5c1b

title: "Windows Process Creation: WinAPI Function Names in Command-Line"
id: 307e4607-4a6d-4b5f-9fef-c0e3b842e412
related:
  - id: 03d83090-8cba-44a0-b02f-0b756a050306
    type: derived
  - id: ba3f5c1b-6272-4119-9dbd-0bc8d21c2702
    type: derived
status: test
description: This rule flags Windows process creation events where the command line contains multiple WinAPI-related function or module names (e.g., kernel32, ntdll, LoadLibrary, GetProcAddress, OpenProcess, VirtualAlloc). Attackers may use these API references to load functions dynamically, manipulate tokens/processes, or perform in-memory operations during execution. The detection relies on process creation telemetry with access to the full command line string.
references:
  - https://twitter.com/m417z/status/1566674631788007425
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_inline_win_api_access.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-06
modified: 2025-03-06
tags:
  - attack.execution
  - attack.t1106
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - AddSecurityPackage
      - AdjustTokenPrivileges
      - Advapi32
      - CloseHandle
      - CreateProcessWithToken
      - CreatePseudoConsole
      - CreateRemoteThread
      - CreateThread
      - CreateUserThread
      - DangerousGetHandle
      - DuplicateTokenEx
      - EnumerateSecurityPackages
      - FreeHGlobal
      - FreeLibrary
      - GetDelegateForFunctionPointer
      - GetLogonSessionData
      - GetModuleHandle
      - GetProcAddress
      - GetProcessHandle
      - GetTokenInformation
      - ImpersonateLoggedOnUser
      - kernel32
      - LoadLibrary
      - memcpy
      - MiniDumpWriteDump
      - ntdll
      - OpenDesktop
      - OpenProcess
      - OpenProcessToken
      - OpenThreadToken
      - OpenWindowStation
      - PtrToString
      - QueueUserApc
      - ReadProcessMemory
      - RevertToSelf
      - RtlCreateUserThread
      - secur32
      - SetThreadToken
      - VirtualAlloc
      - VirtualFree
      - VirtualProtect
      - WaitForSingleObject
      - WriteInt32
      - WriteProcessMemory
      - ZeroFreeGlobalAllocUnicode
  filter_optional_mpcmdrun:
    Image|endswith: \MpCmdRun.exe
    CommandLine|contains: GetLoadLibraryWAddress32
  filter_optional_compatTelRunner:
    ParentImage|endswith: \CompatTelRunner.exe
    CommandLine|contains:
      - FreeHGlobal
      - PtrToString
      - kernel32
      - CloseHandle
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Some legitimate action or applications may use these functions. Investigate further to determine the legitimacy of the activity.
level: high
license: DRL-1.1

What it detects

This rule flags Windows process creation events where the command line contains multiple WinAPI-related function or module names (e.g., kernel32, ntdll, LoadLibrary, GetProcAddress, OpenProcess, VirtualAlloc). Attackers may use these API references to load functions dynamically, manipulate tokens/processes, or perform in-memory operations during execution. The detection relies on process creation telemetry with access to the full command line string.

Known false positives

Some legitimate action or applications may use these functions. Investigate further to determine the legitimacy of the activity.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.