自动化接入 · API / MCP EN

技术说明 · T1106

Native API

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations. Adversaries may abuse these OS API functions as a means of executing behaviors. Similar to Command and Scripting Interpreter, the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system. Native API functions (such as <code>NtCreateProcess</code>) may be directly invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries. For example, functions such as the Windows API <code>CreateProcess()</code> or GNU <code>fork()</code> will allow programs and scripts to start other processes. This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations. Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code. Adversaries may use assembly to directly or indirectly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks. Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via Disable or Modify Tools.

ATT&CK T1106 platforms — 状态 有效 版本 20.1

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.12 These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations. Adversaries may abuse these OS API functions as a means of executing behaviors. Similar to Command and Scripting Interpreter, the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system. Native API functions (such as <code>NtCreateProcess</code>) may be directly invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.345 For example, functions such as the Windows API <code>CreateProcess()</code> or GNU <code>fork()</code> will allow programs and scripts to start other processes.67 This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.8910 Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.11121314 Adversaries may use assembly to directly or indirectly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks.15 Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via Disable or Modify Tools.

  1. NT API Windows
  2. Linux Kernel API
  3. OutFlank System Calls
  4. CyberBit System Calls
  5. MDSec System Calls
  6. Microsoft CreateProcess
  7. GNU Fork
  8. Microsoft Win32
  9. LIBC
  10. GLIBC
  11. Microsoft NET
  12. Apple Core Services
  13. MACOS Cocoa
  14. macOS Foundation
  15. Redops Syscalls

使用该技术的组织

组织名称国家
grp_g0090WIRTE—
grp_g1008SideCopyPakistan
grp_g0129Mustang PandaChina
grp_g0032Lazarus GroupDPRK
grp_g0078Gorgon Group—
grp_g1051Medusa Group—
grp_g0114ChimeraChina
grp_g0126Higaisa—
grp_g0067APT37DPRK
grp_g0082APT38DPRK
grp_g0081Tropic Trooper—
grp_g0091Silence—
grp_g1059NIMBUS MANTICORE—
grp_g0010TurlaRussia
grp_g0047Gamaredon GroupRussia
grp_g0092TA505—
grp_g0094KimsukyDPRK
grp_g0098BlackTechChina
grp_g0045menuPass—
grp_g1022ToddyCat—
grp_g0034Sandworm TeamRussia

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。