Query: write Sigma for Detects usage of WinAPI functions in PowerShell scripts. It may indicate attempts to perform actions such as process inj
Matching passage: Sigma rule: Detects usage of WinAPI functions in PowerShell scripts. It may indicate attempts to perform actions such as process inj. Logsource: windows / ps_script. Rule: title: Potential WinAPI Calls Via PowerShell Scripts id: 03d83090-8cba-44a0-b02f-0b756a050306 related: - id: ba3f5c1b-6272-4119-9dbd-0bc8d21c2702 type: similar status: test description: 'Detects usage of WinAPI functions in PowerShell scripts. It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls. These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory. ' references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse - https://github.com/PowerShellMafia/PowerSploit/blob/1980f403ee78234eae4d93b50890d02f827a099f/CodeExecution/Invoke-Shellcode.ps1 - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/ author: Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community date: 2020-10-06 modified: 2026-04-29 tags: - attack.execution - attack.t1059.001 - attack.t1106 - attack.stealth - attack.t1620 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_injection: ScriptBlockText|contains|all: - VirtualAlloc - OpenProcess - WriteProcessMemory - CreateRemoteThread selection_token_steal: ScriptBlockText|contains|all: - OpenProcessToken - LookupPrivilegeValue - AdjustTokenPrivileges selection_duplicate_token: ScriptBlockText|contains|all: - OpenProcessToken - DuplicateTokenEx - CloseHandle selection_process_write_read: ScriptBlockText|contains|all: - WriteProcessMemory - VirtualAlloc - ReadProcessMemory - VirtualFree selection_local_shellcode_injection: ScriptBlockText|contains|all: - VirtualAlloc - GetDelegateForFunctionPointer - Marshal.Copy condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects if the secret scanning feature is disabled for an enterprise or repository.. Logsource: github / audit. Rule: title: Github Secret Scanning Feature Disabled id: 3883d9a0-fd0f-440f-afbb-445a2a799bb8 status: test description: Detects if the secret scanning feature is disabled for an enterprise or repository. references: - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/about-secret-scanning author: Muhammad Faisal (@faisalusuf) date: 2024-03-07 modified: 2024-07-19 tags: - attack.defense-impairment - attack.t1685 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - business_secret_scanning.disable - business_secret_scanning.disabled_for_new_repos - repository_secret_scanning.disable - secret_scanning_new_repos.disable - secret_scanning.disable condition: selection falsepositives: - Allowed administrative activities. level: high