MITRE ATT&CKtechnique

T1106 Native API

Published 2017-05-31 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Execution
Platforms
Linux, macOS, Windows
Version
2.3
Created
2017-05-31

Description

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations. Adversaries may abuse these OS API functions as a means of executing behaviors. Similar to Command and Scripting Interpreter, the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system. Native API functions (such as NtCreateProcess) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries. For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes. This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations. Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code. Adversaries may use assembly to directly or in-directly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks. Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via Disable or Modify Tools.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1038 Execution Prevention mitigation
  • M1040 Behavior Prevention on Endpoint mitigation

Referenced by MITRE ATT&CK · uses (236)

  • G1059 NIMBUS MANTICORE group
  • S9067 TWOSTROKE software (malware)
  • S9061 LIGHTRAIL software (malware)
  • S9057 CRASHPAD software (malware)
  • S9058 SIGHTGRAB software (malware)
  • S9053 MiniJunk software (malware)
  • S9051 The Gentlemen Ransomware software (malware)
  • S9050 Vidar software (malware)
  • S9038 DynoWiper software (malware)
  • S9036 LP-Notes software (malware)
  • S9037 RustyWater software (malware)
  • S9032 MuddyViper software (malware)
  • S9033 Fooder software (malware)
  • C0061 Operation Digital Eye campaign
  • S9027 ANELLDR software (malware)
  • S9020 LODEINFO software (malware)
  • S9021 DOWNIISSA software (malware)
  • S9025 NOOPLDR software (malware)
  • S9016 Caminho software (malware)
  • S9018 HeartCrypt software (malware)
  • S9012 TRAILBLAZE software (malware)
  • S9007 HTTPTroy software (malware)
  • S9001 SystemBC software (malware)
  • S1247 Embargo software (malware)
  • S1244 Medusa Ransomware software (malware)
  • G1051 Medusa Group group
  • S1242 Qilin software (malware)
  • S1239 TONESHELL software (malware)
  • S1232 SplatDropper software (malware)
  • S1233 PAKLOG software (malware)
Show all 236 ›

Referenced by Compliance · mitigates (8)

  • CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References