Automation · API / MCP 中文

Technique note · T1106

Native API

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations. Adversaries may abuse these OS API functions as a means of executing behaviors. Similar to Command and Scripting Interpreter, the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system. Native API functions (such as <code>NtCreateProcess</code>) may be directly invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries. For example, functions such as the Windows API <code>CreateProcess()</code> or GNU <code>fork()</code> will allow programs and scripts to start other processes. This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations. Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code. Adversaries may use assembly to directly or indirectly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks. Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via Disable or Modify Tools.

ATT&CK T1106 platforms — Status Active Version 20.1

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.12 These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations. Adversaries may abuse these OS API functions as a means of executing behaviors. Similar to Command and Scripting Interpreter, the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system. Native API functions (such as <code>NtCreateProcess</code>) may be directly invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.345 For example, functions such as the Windows API <code>CreateProcess()</code> or GNU <code>fork()</code> will allow programs and scripts to start other processes.67 This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.8910 Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.11121314 Adversaries may use assembly to directly or indirectly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks.15 Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via Disable or Modify Tools.

  1. NT API Windows
  2. Linux Kernel API
  3. OutFlank System Calls
  4. CyberBit System Calls
  5. MDSec System Calls
  6. Microsoft CreateProcess
  7. GNU Fork
  8. Microsoft Win32
  9. LIBC
  10. GLIBC
  11. Microsoft NET
  12. Apple Core Services
  13. MACOS Cocoa
  14. macOS Foundation
  15. Redops Syscalls

Groups using this technique

GroupNameCountry
grp_g0090WIRTE—
grp_g1008SideCopyPakistan
grp_g0129Mustang PandaChina
grp_g0032Lazarus GroupDPRK
grp_g0078Gorgon Group—
grp_g1051Medusa Group—
grp_g0114ChimeraChina
grp_g0126Higaisa—
grp_g0067APT37DPRK
grp_g0082APT38DPRK
grp_g0081Tropic Trooper—
grp_g0091Silence—
grp_g1059NIMBUS MANTICORE—
grp_g0010TurlaRussia
grp_g0047Gamaredon GroupRussia
grp_g0092TA505—
grp_g0094KimsukyDPRK
grp_g0098BlackTechChina
grp_g0045menuPass—
grp_g1022ToddyCat—
grp_g0034Sandworm TeamRussia

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.