Applied Cybernetics Group
T1106 Native API
- Technique
T1106- Tactics
- Execution
- Research, 90 days
- 3
- KEV CVEs mapped
- 7
- SigmaHQ rules
- 14
- Elastic, Splunk
- 18
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1106
MITRE description
Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations. Adversaries may abuse these OS API functions as a means of executing behaviors. Similar to [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system. Native API functions (such as <code>NtCreateProcess</code>) may be directly invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.(Citation: OutFlank System Calls)(Citation: CyberBit System Calls)(Citation: MDSec System Calls) For example, functions such as the Windows API <code>CreateProcess()</code> or GNU <code>fork()</code> will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC) Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation) Adversaries may use assembly to directly or indirectly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks.(Citation: Redops Syscalls) Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685).
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-11-03Flare: Inside a Microsoft Lookalike Domain Masquerading as Czech Company’s IT Department Infrastructure -
2026-10-08ESET: MATCHBOIL: New tricks, same old evil intentions -
2026-09-17ESET: Beware the SparroWock: The backdoor that bites, the commands that catch
Detection coverage
SigmaHQ community rules
- Turla Group Named Pipes (emerging-threats)
- WinAPI Library Calls Via PowerShell Scripts (threat-hunting)
- WinAPI Function Calls Via PowerShell Scripts (threat-hunting)
- BPFDoor Abnormal Process ID or Lock File Accessed (core)
- HackTool - WinPwn Execution - ScriptBlock (core)
- Potential WinAPI Calls Via PowerShell Scripts (core)
- HackTool - CobaltStrike BOF Injection Pattern (core)
- HackTool - HandleKatz Duplicating LSASS Handle (core)
- Potential Direct Syscall of NtOpenProcess (core)
- Potential Binary Proxy Execution Via Cdb.EXE (core)
- HackTool - RedMimicry Winnti Playbook Execution (core)
- HackTool - WinPwn Execution (core)
- Suspicious Mshta.EXE Execution Patterns (core)
- Potential WinAPI Calls Via CommandLine (core)
Elastic and Splunk rules
- Potential Fileless Execution via Unusual memfd Create Call (elastic)
- Abnormal Process ID or Lock File Created (elastic)
- Network Connection from Binary with RWX Memory Region (elastic)
- Unknown Execution of Binary with RWX Memory Region (elastic)
- PowerShell Suspicious Script with Audio Capture Capabilities (elastic)
- PowerShell Keylogging Script (elastic)
- LSASS Process Access via Windows API (elastic)
- PowerShell Kerberos Ticket Dump (elastic)
- Potential Credential Access via LSASS Memory Dump (elastic)
- Potential Process Injection via PowerShell (elastic)
- Suspicious Process Access via Direct System Call (elastic)
- PowerShell Share Enumeration Script (elastic)
- PowerShell Suspicious Discovery Related Windows API Functions (elastic)
- Suspicious SolarWinds Child Process (elastic)
- PowerShell PSReflect Script (elastic)
- Persistence via Hidden Run Key Detected (elastic)
- PowerShell Script with Token Impersonation Capabilities (elastic)
- Linux Auditd Process Image Change Under Same PID (splunk)