T1027.007 — Dynamic API Resolution

Tactic: Stealth · Platforms: Windows

Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various Native API functions provided by the OS to perform various tasks such as those involving processes,…

Sub-technique of Obfuscated Files or Information (T1027).

Sigma detection rules (1)

T1027.007 Obfuscated Files or Information: Dynamic API Resolution

title: "T1027.007 Obfuscated Files or Information: Dynamic API Resolution"
id: 709354d5-82e1-4191-a45a-b1b6809029c4
description: 'Detection Strategy for Dynamic API Resolution via Reflection-Based P/Invoke Declarations in Command-Line Telemetry. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: APILoadWithoutImport, TimeWindow, EntropyThreshold, StackTraceFilter.'
references:
  - https://attack.mitre.org/techniques/T1027/007
author: Shahrukh Khan
date: 2026-04-28
license: MIT
tags:
  - attack.stealth
  - attack.t1027.007

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    CommandLine|contains|all:
      - 'DllImport'
      - 'GetProcAddress'

  selection_alt:
    CommandLine|contains|all:
      - 'DllImport'
      - 'LoadLibrary'

  condition: 1 of selection*

falsepositives:
  - Standard process-creation telemetry has very limited visibility into in-process API resolution; this rule only catches cases where a PowerShell/.NET reflection script declares a P/Invoke signature (DllImport) alongside GetProcAddress/LoadLibrary in a visible command line, not compiled malware doing this in native code.

level: informational

Related sub-techniques

Explore