Sunturai
Back to results
HighSigmaHQNasreddine Bencherchali (Nextron Systems)

Potential WinAPI Calls Via CommandLine

Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec

Detection logic

Detection requirements

Platform
LinuxmacOSWindows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source product
windows
Log source category
process_creation

Known benign triggers

  • Some legitimate action or applications may use these functions. Investigate further to determine the legitimacy of the activity.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice