Potential WinAPI Calls Via PowerShell Scripts

SigmaHQ Detections@sigmaHQ

•updated Apr 29, 2026•0•0•4

Detects usage of WinAPI functions in PowerShell scripts. It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls. These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.