Potential WinAPI Calls Via CommandLine
Detects the use of Windows API (WinAPI) functions being called directly via the command line. This technique is often used by threat actors, for example, with tools like winapiexec, to perform various malicious actions such as privilege escalation, process injection, or credential dumping by directly interacting with low-level operating system functions. The rule specifically looks for a wide range of sensitive WinAPI function names and DLLs in the command line arguments of newly created processes.
Sigma
