Windows Process Creation: WinAPI Function Names in Command-Line
Alerts on Windows processes whose command lines reference WinAPI functions/modules commonly used for dynamic invocation and memory/process manipulation.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-06
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the command line contains multiple WinAPI-related function or module names (e.g., kernel32, ntdll, LoadLibrary, GetProcAddress, OpenProcess, VirtualAlloc). Attackers may use these API references to load functions dynamically, manipulate tokens/processes, or perform in-memory operations during execution. The detection relies on process creation telemetry with access to the full command line string.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: WinAPI Function Names in Command-Line"
id: 307e4607-4a6d-4b5f-9fef-c0e3b842e412
related:
- id: 03d83090-8cba-44a0-b02f-0b756a050306
type: derived
- id: ba3f5c1b-6272-4119-9dbd-0bc8d21c2702
type: derived
status: test
description: This rule flags Windows process creation events where the command line contains multiple WinAPI-related function or module names (e.g., kernel32, ntdll, LoadLibrary, GetProcAddress, OpenProcess, VirtualAlloc). Attackers may use these API references to load functions dynamically, manipulate tokens/processes, or perform in-memory operations during execution. The detection relies on process creation telemetry with access to the full command line string.
references:
- https://twitter.com/m417z/status/1566674631788007425
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_inline_win_api_access.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-06
modified: 2025-03-06
tags:
- attack.execution
- attack.t1106
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- AddSecurityPackage
- AdjustTokenPrivileges
- Advapi32
- CloseHandle
- CreateProcessWithToken
- CreatePseudoConsole
- CreateRemoteThread
- CreateThread
- CreateUserThread
- DangerousGetHandle
- DuplicateTokenEx
- EnumerateSecurityPackages
- FreeHGlobal
- FreeLibrary
- GetDelegateForFunctionPointer
- GetLogonSessionData
- GetModuleHandle
- GetProcAddress
- GetProcessHandle
- GetTokenInformation
- ImpersonateLoggedOnUser
- kernel32
- LoadLibrary
- memcpy
- MiniDumpWriteDump
- ntdll
- OpenDesktop
- OpenProcess
- OpenProcessToken
- OpenThreadToken
- OpenWindowStation
- PtrToString
- QueueUserApc
- ReadProcessMemory
- RevertToSelf
- RtlCreateUserThread
- secur32
- SetThreadToken
- VirtualAlloc
- VirtualFree
- VirtualProtect
- WaitForSingleObject
- WriteInt32
- WriteProcessMemory
- ZeroFreeGlobalAllocUnicode
filter_optional_mpcmdrun:
Image|endswith: \MpCmdRun.exe
CommandLine|contains: GetLoadLibraryWAddress32
filter_optional_compatTelRunner:
ParentImage|endswith: \CompatTelRunner.exe
CommandLine|contains:
- FreeHGlobal
- PtrToString
- kernel32
- CloseHandle
condition: selection and not 1 of filter_optional_*
falsepositives:
- Some legitimate action or applications may use these functions. Investigate further to determine the legitimacy of the activity.
level: high
license: DRL-1.1