posh_ps_accessing_win_api.yml

title: Accessing WinAPI in PowerShell
id: 03d83090-8cba-44a0-b02f-0b756a050306
status: experimental
description: Detecting use WinAPI Functions in PowerShell
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
author: Nikita Nazarov, oscd.community, Tim Shelton
date: 2020/10/06
modified: 2022/09/29
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1106
logsource:
    product: windows
    category: ps_script
    definition: Script block logging must be enabled
detection:
    selection:
        ScriptBlockText|contains:
            - 'WaitForSingleObject'
            - 'QueueUserApc'
            - 'RtlCreateUserThread'
            - 'OpenProcess'
            - 'VirtualAlloc'
            - 'VirtualFree'
            - 'WriteProcessMemory'
            - 'CreateUserThread'
            - 'CloseHandle'
            - 'GetDelegateForFunctionPointer'
            - 'CreateThread'
            - 'memcpy'
            - 'LoadLibrary'
            - 'GetModuleHandle'
            - 'GetProcAddress'
            - 'VirtualProtect'
            - 'FreeLibrary'
            - 'ReadProcessMemory'
            - 'CreateRemoteThread'
            - 'AdjustTokenPrivileges'
            # - 'WriteByte'  # FP with .NET System.IO.FileStream
            - 'WriteInt32'
            - 'OpenThreadToken'
            # - 'PtrToString'
            # - 'FreeHGlobal'
            - 'ZeroFreeGlobalAllocUnicode'
            - 'OpenProcessToken'
            - 'GetTokenInformation'
            - 'SetThreadToken'
            - 'ImpersonateLoggedOnUser'
            - 'RevertToSelf'
            - 'GetLogonSessionData'
            - 'CreateProcessWithToken'
            - 'DuplicateTokenEx'
            - 'OpenWindowStation'
            - 'OpenDesktop'
            - 'MiniDumpWriteDump'
            - 'AddSecurityPackage'
            - 'EnumerateSecurityPackages'
            - 'GetProcessHandle'
            - 'DangerousGetHandle'
            - 'kernel32'
            - 'Advapi32'
            - 'msvcrt'
            - 'ntdll'
            # - 'user32'  # FP with chocolatey
            - 'secur32'
    falsepositive1:
        ScriptBlockText|startswith: '# Copyright 2016 Amazon.com, Inc. or its affiliates.' # aws scripts leverage CreateFile and CloseHandle may filter out these 2 items
    condition: selection and not 1 of falsepositive*
falsepositives:
    - Carbon PowerShell Module (https://github.com/webmd-health-services/Carbon)
level: high