Windows PowerShell ScriptBlock WinAPI Function Calls

Find PowerShell script blocks that reference WinAPI/native-call function names tied to process, memory, token, or thread operations.

FreeReviewedSigma · Medium · v5

Product: windows
Category: ps_script
Author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2023-07-21
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
- T1106Native API
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell script content that contains references to specific WinAPI and related API functions. Attackers may use direct Windows API calls within PowerShell to perform process, memory, token, thread, and module operations while bypassing expectations based on typical PowerShell function patterns. It relies on Script Block Logging telemetry to capture the script block text and matches it against a defined set of function name substrings.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

PowerShell Scripts Calling WinAPI DLLs on Windows

PowerShell Script Block WinAPI Calls Indicative of Injection or Token Abuse (Windows)

Suspicious Script Interpreter Spawned by Explorer via ClickFix Run Dialog (via process_creation)

Suspicious PowerShell Download Cradle via ClickFix Fake CAPTCHA (via process_creation)

Suspicious PowerShell EncodedCommand Spawned From Command Shell via Process Creation

Suspicious Script Download via Curl and PowerShell by Dohdoor

Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware

Suspicious PowerShell WebClient DownloadFile of Archive Payload (UAT-7237)

Suspicious SharePoint Worker Process Spawning Command Interpreter via ToolShell

Windows PowerShell ScriptBlock WinAPI Function Calls

Pivot detection · T1059.001 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-winapi-function-calls-from-powershell-script-blocks-9f22ccd5

title: Windows PowerShell ScriptBlock WinAPI Function Calls
id: d411102a-ef98-498c-b38c-77e8226e35b5
related:
  - id: ba3f5c1b-6272-4119-9dbd-0bc8d21c2702
    type: similar
  - id: 03d83090-8cba-44a0-b02f-0b756a050306
    type: similar
  - id: 19d65a1c-8540-4140-8062-8eb00db0bba5
    type: similar
  - id: 9f22ccd5-a435-453b-af96-bf99cbb594d4
    type: derived
status: test
description: This rule flags PowerShell script content that contains references to specific WinAPI and related API functions. Attackers may use direct Windows API calls within PowerShell to perform process, memory, token, thread, and module operations while bypassing expectations based on typical PowerShell function patterns. It relies on Script Block Logging telemetry to capture the script block text and matches it against a defined set of function name substrings.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_win_api_library_access.yml
author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-07-21
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1106
  - detection.threat-hunting
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - AddSecurityPackage
      - AdjustTokenPrivileges
      - CloseHandle
      - CreateProcessWithToken
      - CreateRemoteThread
      - CreateThread
      - CreateUserThread
      - DangerousGetHandle
      - DuplicateTokenEx
      - EnumerateSecurityPackages
      - FreeLibrary
      - GetDelegateForFunctionPointer
      - GetLogonSessionData
      - GetModuleHandle
      - GetProcAddress
      - GetProcessHandle
      - GetTokenInformation
      - ImpersonateLoggedOnUser
      - LoadLibrary
      - memcpy
      - MiniDumpWriteDump
      - OpenDesktop
      - OpenProcess
      - OpenProcessToken
      - OpenThreadToken
      - OpenWindowStation
      - QueueUserApc
      - ReadProcessMemory
      - RevertToSelf
      - RtlCreateUserThread
      - SetThreadToken
      - VirtualAlloc
      - VirtualFree
      - VirtualProtect
      - WaitForSingleObject
      - WriteInt32
      - WriteProcessMemory
      - ZeroFreeGlobalAllocUnicode
  condition: selection
falsepositives:
  - This rule is mainly used for hunting and will generate quite a lot of false positives when applied in production. It's best combined with other fields such as the path of execution, the parent process, etc.
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL