Skip to content
Threat Feed
Subscribe

Tag

Winapi

1 brief RSS
high advisory

Detection of Potential WinAPI Calls via PowerShell Scripts for Evasion

This brief details the detection of PowerShell scripts that leverage Windows API functions, a common technique employed by threat actors for process injection, token manipulation, and other evasive malicious activities to bypass traditional security controls.

powershell winapi evasion process-injection privilege-escalation token-manipulation endpoint windows
1r 3t