tfMITRE ATT&CK sub-technique

Dynamic API Resolution T1027.007

sub-technique of T1027 Obfuscated Files or Information

Tactic: Stealth
Platform: Windows
Version: 2.0
Created: 22 August 2022
Last modified: 12 May 2026

Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various Native API functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 20%

Tools & malware80th percentile · 80% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Dynamic API Resolution MITRE reference T1027.007

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Mustang PandaG0129 ↗

Has leveraged obfuscated Windows API function calls that were concealed as unique names, or hashes of the Windows API.1

created 2021-04-121 referenceaka TA416

KimsukyG0094 ↗

Has leveraged dynamic API resolution using custom hashing techniques.1

created 2019-08-261 referenceaka Black Banshee

Lazarus GroupG0032 ↗

Has used a custom hashing method to resolve APIs used in shellcode.1

created 2017-05-311 referenceaka Labyrinth Chollima

All 3 groups for this technique

Offense vs defense T1027.007

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Dynamic API Resolution detection strategy DET0091

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Dynamic API Resolution via Hash-Based Function Lookups

Enterprise

1 platform

AN0250 · Windows

Behavioral chain involving suspicious use of GetProcAddress and LoadLibrary following memory allocation and manual mapping, often paired with low entropy strings, abnormal API use without static import tables, or delayed module load behaviors.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
OS API ExecutionDC0021	etw:Microsoft-Windows-Kernel-Process	API tracing / stack tracing via ETW or telemetry-based EDR
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
APILoadWithoutImport	Tunable logic to flag suspicious modules used without static IAT entries
TimeWindow	Correlates module load to suspicious memory allocation or API lookup within timeframe
EntropyThreshold	Used to detect obfuscated strings or hashed function names
StackTraceFilter	Optional filtering of known safe modules or patterns from telemetry

Tests1ExecutorsPowerShell 1Need elevation1 of 1Have prerequisites1Have cleanup1Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Dynamic API Resolution-Ninja-syscall

windows

PowerShell

Required

Yes

This test calls NtCreateFile via API hashing and dynamic syscall resolution. I have dubbed this particular combination of techniques 'Ninja-syscall'. When successful, a new file named 'hello.log' will be created in the default user's temporary folder, which is a common location for a dropper.

Input arguments

Name	Type	Default	Description
exe_binary	path	PathToAtomicsFolder\T1027.007\bin\ninja_syscall1.exe	PE binary

Attack command

Start-Process "#{exe_binary}"
Start-Sleep -Seconds 7
if (Test-Path "C:\Users\Default\AppData\Local\Temp\hello.log") { Remove-Item "C:\Users\Default\AppData\Local\Temp\hello.log" -Force; Write-Host "[+] hello.log removed." }

Cleanup command

if (Test-Path "C:\Users\Default\AppData\Local\Temp\hello.log") { Remove-Item "C:\Users\Default\AppData\Local\Temp\hello.log" -Force; Write-Host "[+] hello.log removed." }

Prerequisite

Portable Executable to run must exist at specified location (#{exe_binary})

Check

if (Test-Path "#{exe_binary}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{exe_binary}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1027.007/bin/ninja_syscall1.exe" -OutFile "#{exe_binary}"

GUID34f1878c-47d2-4670-8b86-6c97cab8d40f

Tests from Atomic Red Team (MIT licence) · technique definition

Dynamic API Resolution detections T1027.007

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs