mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-08 02:08:54 +00:00
72 lines
2.0 KiB
YAML
72 lines
2.0 KiB
YAML
title: Accessing WinAPI in PowerShell
|
|
id: 03d83090-8cba-44a0-b02f-0b756a050306
|
|
status: experimental
|
|
description: Detecting use WinAPI Functions in PowerShell
|
|
author: Nikita Nazarov, oscd.community
|
|
date: 2020/10/06
|
|
references:
|
|
- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
|
|
tags:
|
|
- attack.execution
|
|
- attack.t1059.001
|
|
- attack.t1106
|
|
logsource:
|
|
product: windows
|
|
service: powershell
|
|
detection:
|
|
selection:
|
|
EventID:
|
|
- 4104
|
|
Message|contains:
|
|
- 'WaitForSingleObject'
|
|
- 'QueueUserApc'
|
|
- 'RtlCreateUserThread'
|
|
- 'OpenProcess'
|
|
- 'VirtualAlloc'
|
|
- 'VirtualFree'
|
|
- 'WriteProcessMemory'
|
|
- 'CreateUserThread'
|
|
- 'CloseHanlde'
|
|
- 'GetDelegateForFunctionPointer'
|
|
- 'CreateThread'
|
|
- 'memcpy'
|
|
- 'LoadLibrary'
|
|
- 'GetModuleHandle'
|
|
- 'GetProcAdress'
|
|
- 'VirtualProtect'
|
|
- 'FreeLibrary'
|
|
- 'ReadProcessMemory'
|
|
- 'CreateRemoteThread'
|
|
- 'AdjustTokenPrivileges'
|
|
- 'WriteByte'
|
|
- 'WriteInt32'
|
|
- 'OpenThreadToken'
|
|
- 'PtrToString'
|
|
- 'FreeHGlobal'
|
|
- 'ZeroFreeGlobalAllocUnicode'
|
|
- 'OpenProcessToken'
|
|
- 'GetTokenInformation'
|
|
- 'SetThreadToken'
|
|
- 'ImpersonateLoggedOnUser'
|
|
- 'RevertToSelf'
|
|
- 'GetLogonSessionData'
|
|
- 'CreateProcessWithToken'
|
|
- 'DuplicateRokenEx'
|
|
- 'OpenWindowStation'
|
|
- 'OpenDesktop'
|
|
- 'MiniDumpWrireDump'
|
|
- 'AddSecurityPackage'
|
|
- 'EnumerateSecurityPackages'
|
|
- 'GetProcessHandle'
|
|
- 'DangerousGetHandle'
|
|
- 'Kernel32'
|
|
- 'Advapi32'
|
|
- 'Msvcrt'
|
|
- 'ntdll'
|
|
- 'User32'
|
|
- 'Secur32'
|
|
condition: selection
|
|
falsepositives:
|
|
- Unknown
|
|
level: high
|