Cross-source coverage
T1106 / ATT&CK
Native API
61 rules · 60 families across 7 sources.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Adversaries may abuse these OS API functions as a means of executing behaviors. Similar to Command and Scripting Interpreter, the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system.
Native API functions (such as NtCreateProcess) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries. For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes. This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.
Higher level software frameworks, such as Microsoft.NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.
Adversaries may use assembly to directly or in-directly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks. Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via Disable or Modify Tools.
- Tactics
- Execution
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:Sysmonauditd:SYSCALLmacos:unifiedlogmacos:endpointsecurity
How MITRE says to detect it DET0529
Behavioral Detection of Native API Invocation via Unusual DLL Loads and Direct Syscalls
Windows Analytic 1465
Unusual or suspicious processes loading critical native API DLLs (e.g., ntdll.dll, kernel32.dll) followed by direct syscall behavior, memory manipulation, or hollowing.
WinEventLog:SysmonEventCode=7WinEventLog:SysmonEventCode=10WinEventLog:SysmonEventCode=1
Linux Analytic 1466
Userland processes invoking syscall-heavy libraries (libc, glibc) followed by fork, mmap, or ptrace behavior commonly associated with code injection or memory manipulation.
auditd:SYSCALLexecve, fork, mmap, ptraceauditd:SYSCALLmodule load or memory map path
macOS Analytic 1467
Execution of processes that link to CoreServices or Foundation APIs followed by creation of memory regions, code execution, or abnormal library injection.
macos:unifiedloglaunch and dylib loadmacos:endpointsecurityES_EVENT_TYPE_NOTIFY_EXEC
elastic/protections-artifacts
23 rules| Detection | Severity | Format |
|---|---|---|
| Egress Network Connection Followed by Memory File Descriptor Creation | Undefined | Elastic TOML |
| Egress Network Connection from Memory File Descriptor | Undefined | Elastic TOML |
| Execution of Memory File Descriptor via Interactive Session | Undefined | Elastic TOML |
| Execution of Memory File Descriptor via Suspicious Process | Undefined | Elastic TOML |
| File Creation or Modification via (Memory) File Descriptor | Undefined | Elastic TOML |
| In-Memory JXA Execution via ScriptingAdditions | Undefined | Elastic TOML |
| Loadable Kernel Module Load via Forked Memory File Descriptor | Undefined | Elastic TOML |
| Memory File Descriptor Child Process Execution | Undefined | Elastic TOML |
| Memory File Descriptor Execution from Suspicious Process | Undefined | Elastic TOML |
| Memory File Descriptor Process Execution | Undefined | Elastic TOML |
+ 13 more from elastic/protections-artifacts → showing the 10 highest-severity
elastic/detection-rules
16 rules| Detection | Severity | Format |
|---|---|---|
| Persistence via Hidden Run Key Detected | High | Elastic TOML |
| Potential Credential Access via LSASS Memory Dump | High | Elastic TOML |
| Potential Process Injection via PowerShell | High | Elastic TOML |
| PowerShell Kerberos Ticket Dump | High | Elastic TOML |
| PowerShell Keylogging Script | High | Elastic TOML |
| PowerShell PSReflect Script | High | Elastic TOML |
| PowerShell Share Enumeration Script | High | Elastic TOML |
| PowerShell Suspicious Script with Audio Capture Capabilities | High | Elastic TOML |
| Suspicious Process Access via Direct System Call | High | Elastic TOML |
| Abnormal Process ID or Lock File Created | Medium | Elastic TOML |
+ 6 more from elastic/detection-rules → showing the 10 highest-severity
SigmaHQ/sigma
14 rules| Detection | Severity | Format |
|---|---|---|
| Turla Group Named Pipes | Critical | Sigma |
| BPFDoor Abnormal Process ID or Lock File Accessed | High | Sigma |
| HackTool - CobaltStrike BOF Injection Pattern | High | Sigma |
| HackTool - HandleKatz Duplicating LSASS Handle | High | Sigma |
| HackTool - RedMimicry Winnti Playbook Execution | High | Sigma |
| HackTool - WinPwn Execution | High | Sigma |
| HackTool - WinPwn Execution - ScriptBlock | High | Sigma |
| Potential WinAPI Calls Via CommandLine | High | Sigma |
| Potential WinAPI Calls Via PowerShell Scripts | High | Sigma |
| Suspicious Mshta.EXE Execution Patterns | High | Sigma |
+ 4 more from SigmaHQ/sigma → showing the 10 highest-severity
socfortress/Wazuh-Rules
4 rules · 3 families| Detection | Severity | Format |
|---|---|---|
| Detects BPFDoor .lock and .pid files access in temporary file storage facility. 2 variants | High | Wazuh XML |
| Detects BPFDoor .lock and .pid files access in temporary file storage facility. 2 variants | High | Wazuh XML |
| Sysmon - Event 1: Process creation · Shellcode Execution via Syscalls (T1106) | High | Wazuh XML |
| Sysmon - Event 1: Process creation · Suspicious Process Creation via Native API (T1106) | High | Wazuh XML |
chronicle/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| flowerpippi_malware_detector_sysmon_behavior | Undefined | YARA-L |
| gelup_malware_detector_sysmon_behavior | Undefined | YARA-L |
Azure/Azure-Sentinel
1 rule| Detection | Severity | Format |
|---|---|---|
| Suspicious VM Instance Creation Activity Detected | Medium | KQL |
Wazuh Core Ruleset
1 rule| Detection | Severity | Format |
|---|---|---|
| Powershell script may be executing suspicious code with CreateThread API | High | Wazuh XML |