Query: detection rule: Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec
Matching passage: Sigma rule: Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec. Logsource: windows / process_creation. Rule: title: Potential WinAPI Calls Via CommandLine id: ba3f5c1b-6272-4119-9dbd-0bc8d21c2702 related: - id: 03d83090-8cba-44a0-b02f-0b756a050306 type: derived status: test description: Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec references: - https://twitter.com/m417z/status/1566674631788007425 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-06 modified: 2025-03-06 tags: - attack.execution - attack.t1106 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - AddSecurityPackage - AdjustTokenPrivileges - Advapi32 - CloseHandle - CreateProcessWithToken - CreatePseudoConsole - CreateRemoteThread - CreateThread - CreateUserThread - DangerousGetHandle - DuplicateTokenEx - EnumerateSecurityPackages - FreeHGlobal - FreeLibrary - GetDelegateForFunctionPointer - GetLogonSessionData - GetModuleHandle - GetProcAddress - GetProcessHandle - GetTokenInformation - ImpersonateLoggedOnUser - kernel32 - LoadLibrary - memcpy - MiniDumpWriteDump - ntdll - OpenDesktop - OpenProcess - OpenProcessToken - OpenThreadToken - OpenWindowStation - PtrToString - QueueUserApc - ReadProcessMemory - RevertToSelf - RtlCreateUserThread - secur32 - SetThreadToken - VirtualAlloc - VirtualFree - VirtualProtect - WaitForSingleObject - WriteInt32 - WriteProcessMemory - ZeroFreeGlobalAllocUnicode filter_optional_mpcmdrun: Image|endswith: \MpCmdRun.exe CommandLine|contains: GetLoadLibraryWAddress32 filter_optional_compatTelRunner: ParentImage|endswith: \CompatTelRunner.exe CommandLine|contains: - FreeHGlobal - PtrToString - kernel32 - CloseHandle condition: selection and not 1 of filter_optional_* falsepositives: - Some legitimate action or applications may use these functions. Investigate further to determine the legitimacy of the activity. level: high
Near-miss passage: Sigma rule: Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of a. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting id: 396ae3eb-4174-4b9b-880e-dc0364d78a19 status: test description: Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53 - https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/ author: Nasreddine Bencherchali (Nextron Systems) date: 2021-04-05 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.command-and-control - attack.t1137 - attack.t1008 - attack.t1546 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Outlook\LoadMacroProviderOnBoot Details|contains: '0x00000001' condition: selection falsepositives: - Unknown level: high