T1106: Native API

Execution Intelligence Profile

AI Answer

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) (Source: MITRE ATT&CK T1106)

Confidence: 0.9 · Source: MITRE ATT&CK · Requires review: yes · Freshness: 2026-09-07

ATT&CK Mapping

Field	Value
Technique ID	T1106
Name	Native API
Tactic	Execution (execution)
Platforms	Linux, macOS, Windows
Sub-technique	No

Why it matters

In the OpenTrojan knowledge graph, Native API (T1106) is one of the highest-connectivity ATT&CK techniques: 228 MITRE STIX relationships reference this technique; 20 threat groups observed using it; 203 software families associated; 5 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.

How attackers use it

Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1106). Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations. Adversaries may abuse these OS API functions as a means of executing behaviors. Similar to Command and Scripting Interpreter, the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system. Native API functions (such as NtCreateProcess) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries. For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes. This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations. Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code. Adversaries may use assembly to directly or in-directly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks. Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via Disable or Modify Tools.

Detection

DET0529 Behavioral Detection of Native API Invocation via Unusual DLL Loads and Direct Syscalls AN1465 Unusual or suspicious processes loading critical native API DLLs (e.g., ntdll.dll, kernel32.dll) followed by direct syscall behavior, memory manipulation, or hollowing. AN1466 Userland processes invoking syscall-heavy libraries (libc, glibc) followed by fork, mmap, or ptrace behavior commonly associated with code injection or memory manipulation. AN1467 Execution of processes that link to CoreServices or Foundation APIs followed by creation of memory regions, code execution, or abnormal library injection.

Detection strategy text is from the MITRE ATT&CK official technique page (https://attack.mitre.org/techniques/T1106).

Mitigation

Prevent the execution of unauthorized or malicious code on systems by implementing application control, script blocking, and other execution prevention mechanisms. This ensures that only trusted and authorized code is executed, reducing the risk of malware and unauthorized actions. This mitigation can be implemented through the following measures:

Application Control:

Use Case: Use tools like AppLocker or Windows Defender Application Control (WDAC) to create whitelists of authorized applications and block unauthorized ones. On Linux, use tools like SELinux or AppArmor to define mandatory access control policies for application execution.
Implementation: Allow only digitally signed or pre-approved applications to execute on servers and endpoints. (e.g., New-AppLockerPolicy -PolicyType Enforced -FilePath "C:\Policies\AppLocker.xml")

Script Blocking:

Use Case: Use script control mechanisms to block unauthorized execution of scripts, such as PowerShell or JavaScript. Web Browsers: Use browser extensions or settings to block JavaScript execution from untrusted sources.
Implementation: Configure PowerShell to enforce Constrained Language Mode for non-administrator users. (e.g., Set-ExecutionPolicy AllSigned)

Executable Blocking:

Use Case: Prevent execution of binaries from suspicious locations, such as %TEMP% or %APPDATA% directories.
Implementation: Block execution of .exe, .bat, or .ps1 files from user-writable directories.

Dynamic Analysis Prevention:

Use Case: Use behavior-based execution prevention tools to identify and block malicious activity in real time.
Implemenation: Employ EDR solutions that analyze runtime behavior and block suspicious code execution.

Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.

TrickBot
Ninja
Pikabot
RCSession
SynAck
Bumblebee
Amadey
RDFSNIFFER
Torisma
Stuxnet
RotaJakiro
AvosLocker

Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).

APT38
SideCopy
Kimsuky
Gorgon Group
menuPass
Gamaredon Group
Sandworm Team
Mustang Panda
APT37
Higaisa
Tropic Trooper
BlackTech

Group associations are from MITRE ATT&CK STIX relationships.

Operation Dream Job
Operation Sharpshooter
Operation Honeybee
Operation Digital Eye
Operation Wocao

Campaign associations are from MITRE ATT&CK STIX relationships.

References

Source Attribution

Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review

Start Investigation

Move from reading to investigating T1106 Native API. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about T1106 Native API?
Evidence — assertions mapped to verifiable references.
Timeline — events in chronological order.
Related Entities — CVE, threat actor, campaign, malware links.
Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.

Start Investigation Open Workspace