Gordon Long, LegioX/Zoom, asaurusrex; Stefan Kanthak; Tristan Madani (Cybereason)
Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.[1][2] These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Adversaries may abuse these OS API functions as a means of executing behaviors. Similar to Command and Scripting Interpreter, the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system.
Native API functions (such as NtCreateProcess) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.[3][4][5] For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.[6][7] This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.[8][9][10]
Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.[11][12][13][14]
Adversaries may use assembly to directly or in-directly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks.[15] Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via Disable or Modify Tools.
Top 8%of all ATT&CK techniques for number of groups
20 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
During Operation Dream Job, Lazarus Group used Windows API ObtainUserAgentString to obtain the victim's User-Agent and used the value to connect to their C2 server.1
During Operation Wocao, threat actors used the CreateProcessA and ShellExecute API functions to launch commands after being injected into a selected process.1
During Operation Sharpshooter, the first stage downloader resolved various Windows libraries and APIs, including LoadLibraryA(), GetProcAddress(), and CreateProcessA().1
During Operation Honeybee, the threat actors deployed malware that used API calls, including CreateProcessAsUser.1
2017–2018
All 5 campaigns for this technique
203 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has used CreateObject to instantiate a WScript.Shell Component Object Model (COM) object.1 Additionally, RustyWater has used VirtualAllocEx and WriteProcessMemory to inject shellcode into explorer.exe.1
Has used the ImpersonateLoggedOnUser API to impersonate the security context of the taskhostw.exe process.1 Additionally, LP-Notes has also used the CredUIPromptForWindowsCredentialsW API to obtain Windows credentials.1
Has used the WinCrypt API for payload decryption, DuplicateTokenEx to duplicate the token of a specified process, and CreateProcessAsUserA for payload execution.1
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of Native API Invocation via Unusual DLL Loads and Direct Syscalls
Enterprise
3 platforms
AN1465 · Windows
Unusual or suspicious processes loading critical native API DLLs (e.g., ntdll.dll, kernel32.dll) followed by direct syscall behavior, memory manipulation, or hollowing.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
DllName
May tune DLL filters to focus on low-level API providers (e.g., ntdll.dll)
Image
Tune for expected parent processes (e.g., explorer.exe, winlogon.exe)
TargetProcess
Scope to suspicious targets like LSASS, csrss, etc.
AN1466 · Linux
Userland processes invoking syscall-heavy libraries (libc, glibc) followed by fork, mmap, or ptrace behavior commonly associated with code injection or memory manipulation.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
SyscallType
Filter for fork, mmap, ptrace based on context
ProcessName
Whitelist known daemon and scheduled task patterns
MAPS Path
Tune suspicious memory map regions (e.g., /tmp/.evilshmem)
AN1467 · macOS
Execution of processes that link to CoreServices or Foundation APIs followed by creation of memory regions, code execution, or abnormal library injection.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Identify and block potentially malicious software executed that may be executed through this technique by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.
Tests5Executorspowershell 4 · command_prompt 1Need elevation0 of 5Have prerequisites1Have cleanup1Platformswindows
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
Execution through API - CreateProcess
windows
command_prompt
—
1
—
Execute program by leveraging Win32 API's. By default, this will launch calc.exe from the command prompt.
Inputs
Name
Description
Type
Default Value
output_file
Location of the payload
path
%tmp%\T1106.exe
source_file
Location of the CSharp source file to compile and execute
Runs shellcode in the current running process via a syscall.
Steps taken with this technique
1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write
2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space
3. Change the memory page permissions to Execute/Read with VirtualProtect
4. Use syscall to execute the entrypoint of the shellcode
- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#syscall)