{"id":"T1106","name":"Native API","url":"https://attack.mitre.org/techniques/T1106","tactics":["execution"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0529","stix_id":"x-mitre-detection-strategy--36654ec6-5019-4e79-b299-1fbf3a03e064","name":"Behavioral Detection of Native API Invocation via Unusual DLL Loads and Direct Syscalls","url":"https://attack.mitre.org/detectionstrategies/DET0529","analytics":[{"id":"AN1465","stix_id":"x-mitre-analytic--2a23296d-70f2-4e04-9a97-62d093ad1765","name":"Analytic 1465","description":"Unusual or suspicious processes loading critical native API DLLs (e.g., ntdll.dll, kernel32.dll) followed by direct syscall behavior, memory manipulation, or hollowing.","url":"https://attack.mitre.org/detectionstrategies/DET0529#AN1465","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"DllName","description":"May tune DLL filters to focus on low-level API providers (e.g., ntdll.dll)"},{"field":"Image","description":"Tune for expected parent processes (e.g., explorer.exe, winlogon.exe)"},{"field":"TargetProcess","description":"Scope to suspicious targets like LSASS, csrss, etc."}],"live":true,"detection_strategies":["DET0529"],"techniques":["T1106"]},{"id":"AN1466","stix_id":"x-mitre-analytic--552ff82d-467b-4aeb-a4c3-084ca24dbd3e","name":"Analytic 1466","description":"Userland processes invoking syscall-heavy libraries (libc, glibc) followed by fork, mmap, or ptrace behavior commonly associated with code injection or memory manipulation.","url":"https://attack.mitre.org/detectionstrategies/DET0529#AN1466","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve, fork, mmap, ptrace","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"module load or memory map path","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"SyscallType","description":"Filter for fork, mmap, ptrace based on context"},{"field":"ProcessName","description":"Whitelist known daemon and scheduled task patterns"},{"field":"MAPS Path","description":"Tune suspicious memory map regions (e.g., /tmp/.evilshmem)"}],"live":true,"detection_strategies":["DET0529"],"techniques":["T1106"]},{"id":"AN1467","stix_id":"x-mitre-analytic--5e02fe2a-7659-4871-b79e-7ea57373aa37","name":"Analytic 1467","description":"Execution of processes that link to CoreServices or Foundation APIs followed by creation of memory regions, code execution, or abnormal library injection.","url":"https://attack.mitre.org/detectionstrategies/DET0529#AN1467","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"launch and dylib load","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"macos-unifiedlog"},{"name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_EXEC","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-endpointsecurity"}],"mutable_elements":[{"field":"API Framework Name","description":"Filter on CoreServices, Cocoa, Foundation framework usage"},{"field":"Execution Context","description":"Tune to exclude known developer tools or test environments"}],"live":true,"detection_strategies":["DET0529"],"techniques":["T1106"]}],"live":true,"version":"1.0","techniques":["T1106"]}],"sigma_rules":[{"id":"03d83090-8cba-44a0-b02f-0b756a050306","title":"Potential WinAPI Calls Via PowerShell Scripts","author":"Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-06","modified":"2026-04-29","description":"Detects usage of WinAPI functions in PowerShell scripts.\nIt may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls.\nThese techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.\n","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse","https://github.com/PowerShellMafia/PowerSploit/blob/1980f403ee78234eae4d93b50890d02f827a099f/CodeExecution/Invoke-Shellcode.ps1","https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001","attack.t1106","attack.stealth","attack.t1620"],"path":"rules/windows/powershell/powershell_script/posh_ps_win_api_susp_access.yml","techniques":["T1059.001","T1106","T1620"],"cves":[]},{"id":"09706624-b7f6-455d-9d02-adee024cee1d","title":"HackTool - CobaltStrike BOF Injection Pattern","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-08-04","modified":"2023-11-28","description":"Detects a typical pattern of a CobaltStrike BOF which inject into other processes","references":["https://github.com/boku7/injectAmsiBypass","https://github.com/boku7/spawn"],"logsource":{"product":"windows","category":"process_access"},"tags":["attack.execution","attack.defense-impairment","attack.t1106","attack.t1685"],"path":"rules/windows/process_access/proc_access_win_hktl_cobaltstrike_bof_injection_pattern.yml","techniques":["T1106","T1685"],"cves":[]},{"id":"19d65a1c-8540-4140-8062-8eb00db0bba5","title":"WinAPI Library Calls Via PowerShell Scripts","author":"Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-07-21","modified":null,"description":"Detects calls to WinAPI libraries from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001","attack.t1106","detection.threat-hunting"],"path":"rules-threat-hunting/windows/powershell/powershell_script/posh_ps_win_api_functions_access.yml","techniques":["T1059.001","T1106"],"cves":[]},{"id":"3f3f3506-1895-401b-9cc3-e86b16e630d0","title":"Potential Direct Syscall of NtOpenProcess","author":"Christian Burkard (Nextron Systems), Tim Shelton (FP)","status":"test","level":"medium","date":"2021-07-28","modified":"2023-12-13","description":"Detects potential calls to NtOpenProcess directly from NTDLL.","references":["https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6"],"logsource":{"product":"windows","category":"process_access"},"tags":["attack.execution","attack.t1106"],"path":"rules/windows/process_access/proc_access_win_susp_direct_ntopenprocess_call.yml","techniques":["T1106"],"cves":[]},{"id":"739915e4-1e70-4778-8b8a-17db02f66db1","title":"Turla Group Named Pipes","author":"Markus Neis","status":"test","level":"critical","date":"2017-11-06","modified":"2021-11-27","description":"Detects a named pipe used by Turla group samples","references":["Internal Research"],"logsource":{"product":"windows","category":"pipe_created"},"tags":["attack.g0010","attack.execution","attack.t1106","detection.emerging-threats"],"path":"rules-emerging-threats/2017/TA/Turla/pipe_created_apt_turla_named_pipes.yml","techniques":["T1106"],"cves":[]},{"id":"808146b2-9332-4d78-9416-d7e47012d83d","title":"BPFDoor Abnormal Process ID or Lock File Accessed","author":"Rafal Piasecki","status":"test","level":"high","date":"2022-08-10","modified":"2026-03-30","description":"detects BPFDoor .lock and .pid files access in temporary file storage facility","references":["https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/","https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor","https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/","https://github.com/rapid7/Rapid7-Labs/blob/741c7196ec12a0a56b63463d1fd726ff14d3a97a/BPFDoor/rapid7_detect_bpfdoor.sh"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.execution","attack.t1106","attack.t1059"],"path":"rules/linux/auditd/path/lnx_auditd_bpfdoor_file_accessed.yml","techniques":["T1106","T1059"],"cves":[]},{"id":"851fd622-b675-4d26-b803-14bc7baa517a","title":"HackTool - WinPwn Execution - ScriptBlock","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-12-04","modified":null,"description":"Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.\n","references":["https://github.com/S3cur3Th1sSh1t/WinPwn","https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841","https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/","https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md","https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.discovery","attack.execution","attack.privilege-escalation","attack.t1046","attack.t1082","attack.t1106","attack.t1518","attack.t1548.002","attack.t1552.001","attack.t1555","attack.t1555.003"],"path":"rules/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml","techniques":["T1046","T1082","T1106","T1518","T1548.002","T1552.001","T1555","T1555.003"],"cves":[]},{"id":"95022b85-ff2a-49fa-939a-d7b8f56eeb9b","title":"HackTool - RedMimicry Winnti Playbook Execution","author":"Alexander Rausch","status":"test","level":"high","date":"2020-06-24","modified":"2023-03-01","description":"Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility","references":["https://redmimicry.com/posts/redmimicry-winnti/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1106","attack.t1059.003","attack.t1218.011"],"path":"rules/windows/process_creation/proc_creation_win_hktl_redmimicry_winnti_playbook.yml","techniques":["T1106","T1059.003","T1218.011"],"cves":[]},{"id":"9f22ccd5-a435-453b-af96-bf99cbb594d4","title":"WinAPI Function Calls Via PowerShell Scripts","author":"Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-07-21","modified":null,"description":"Detects calls to WinAPI functions from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001","attack.t1106","detection.threat-hunting"],"path":"rules-threat-hunting/windows/powershell/powershell_script/posh_ps_win_api_library_access.yml","techniques":["T1059.001","T1106"],"cves":[]},{"id":"b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5","title":"HackTool - HandleKatz Duplicating LSASS Handle","author":"Bhabesh Raj (rule), @thefLinkk","status":"test","level":"high","date":"2022-06-27","modified":"2023-11-28","description":"Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles","references":["https://github.com/codewhitesec/HandleKatz"],"logsource":{"product":"windows","category":"process_access"},"tags":["attack.execution","attack.t1106","attack.t1003.001","attack.credential-access"],"path":"rules/windows/process_access/proc_access_win_hktl_handlekatz_lsass_access.yml","techniques":["T1106","T1003.001"],"cves":[]},{"id":"b5c7395f-e501-4a08-94d4-57fe7a9da9d2","title":"Potential Binary Proxy Execution Via Cdb.EXE","author":"Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2019-10-26","modified":"2024-04-22","description":"Detects usage of \"cdb.exe\" to launch arbitrary processes or commands from a debugger script file","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/","https://web.archive.org/web/20170715043507/http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html","https://twitter.com/nas_bench/status/1534957360032120833"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1106","attack.t1218","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_cdb_arbitrary_command_execution.yml","techniques":["T1106","T1218","T1127"],"cves":[]},{"id":"ba3f5c1b-6272-4119-9dbd-0bc8d21c2702","title":"Potential WinAPI Calls Via CommandLine","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-09-06","modified":"2025-03-06","description":"Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec","references":["https://twitter.com/m417z/status/1566674631788007425"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1106"],"path":"rules/windows/process_creation/proc_creation_win_susp_inline_win_api_access.yml","techniques":["T1106"],"cves":[]},{"id":"d557dc06-62e8-4468-a8e8-7984124908ce","title":"HackTool - WinPwn Execution","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-12-04","modified":null,"description":"Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.\n","references":["https://github.com/S3cur3Th1sSh1t/WinPwn","https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841","https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/","https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md","https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.discovery","attack.execution","attack.privilege-escalation","attack.t1046","attack.t1082","attack.t1106","attack.t1518","attack.t1548.002","attack.t1552.001","attack.t1555","attack.t1555.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_winpwn.yml","techniques":["T1046","T1082","T1106","T1518","T1548.002","T1552.001","T1555","T1555.003"],"cves":[]},{"id":"e32f92d1-523e-49c3-9374-bdb13b46a3ba","title":"Suspicious Mshta.EXE Execution Patterns","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2021-07-17","modified":"2023-02-21","description":"Detects suspicious mshta process execution patterns","references":["https://en.wikipedia.org/wiki/HTML_Application","https://www.echotrail.io/insights/search/mshta.exe","https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1106"],"path":"rules/windows/process_creation/proc_creation_win_mshta_susp_pattern.yml","techniques":["T1106"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-20337","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-20281","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2025-31201","state":"stale","mapping_types":["secondary_impact"]},{"cveID":"CVE-2025-31200","state":"stale","mapping_types":["secondary_impact"]},{"cveID":"CVE-2024-20439","state":"mapped","mapping_types":["primary_impact"]},{"cveID":"CVE-2023-1389","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2020-8657","state":"mapped","mapping_types":["exploitation_technique"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}