T1106 — Native API

Tactic: Execution · Platforms: Linux, macOS, Windows

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by…

Sigma detection rules (3)

T1106 Native API

title: T1106 Native API
id: e44402c8-7d6b-4040-b6dd-d083cb86a23c
description: 'Detects ntdll.dll loaded from a non-standard path (outside System32/SysWOW64) -- a signal of a manually-mapped or freshly-loaded, unhooked copy of ntdll used to invoke native OS APIs directly and bypass higher-level, more heavily monitored Win32 API hooks. (Retargeted from the original process_creation label to image_load -- this is the telemetry source that actually captures this technique behavior; see logsource below.) Direct syscall invocation itself leaves no Sysmon trace, so this non-standard-path load is the closest defensible Windows-observable proxy. Tune using: DllName, Image, TargetProcess.'
references:
  - https://attack.mitre.org/techniques/T1106
author: Shahrukh Khan
date: 2026-05-19
license: MIT
tags:
  - attack.execution
  - attack.t1106

logsource:
  category: image_load
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '7'
    ImageLoaded|endswith: '\ntdll.dll'
  filter_standard_path:
    ImageLoaded|contains:
      - ':\Windows\System32\'
      - ':\Windows\SysWOW64\'

  condition: selection and not filter_standard_path

falsepositives:
  - Applications that legitimately ship or side-load their own copy of ntdll.dll (rare, but occurs with some app-compat shims and packers) will also match.

level: informational

T1106 Native API

title: T1106 Native API
id: b967c9c2-788b-47a3-b1c1-e460002da87b
description: 'Behavioral Detection of Native API / Direct Syscall Invocation on Linux. The prior description referenced Windows-only concepts ("Unusual DLL Loads") on a Linux rule, and its ld.so.preload selector actually detects Dynamic Linker Hijacking (T1574.006), not Native API usage. This version drops the ld.so.preload branch and narrows to ptrace/process_vm_writev syscalls - low-level native-API primitives commonly used to directly manipulate another process''s memory/registers, bypassing higher-level libc wrappers - made by a process that is not a recognized debugger/tracer, since debuggers legitimately call these same syscalls. auditd cannot itself distinguish an in-process direct-assembly syscall from a normal libc-wrapped call; this remains a proxy for native-API-adjacent process manipulation, closer in practice to process-injection techniques (T1055.x) than to a literal T1106 detection. Tune using: SyscallType, ProcessName.'
references:
  - https://attack.mitre.org/techniques/T1106
author: Shahrukh Khan
date: 2026-05-24
license: MIT
tags:
  - attack.execution
  - attack.t1106

logsource:
  category: process_access
  product: linux

detection:
  selection:
    type: SYSCALL
    syscall:
      - ptrace
      - process_vm_writev
    success: 'yes'
  filter_known_debug_tools:
    exe|endswith:
      - '/gdb'
      - '/gdbserver'
      - '/strace'
      - '/ltrace'
      - '/valgrind'

  condition: selection and not filter_known_debug_tools

falsepositives:
  - Container runtimes, sandboxing tools, and profilers not on the excluded list also legitimately use ptrace/process_vm_writev; scope ProcessName further to your environment's known tooling.

level: high

T1106 Native API

title: T1106 Native API
id: b3e70928-b02d-433b-aacb-9ae7721e4152
description: 'Behavioral Detection of Native API Invocation via Unusual DLL Loads and Direct Syscalls. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: API Framework Name, Execution Context.'
references:
  - https://attack.mitre.org/techniques/T1106
author: Shahrukh Khan
date: 2026-01-16
license: MIT
tags:
  - attack.execution
  - attack.t1106

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/osascript'
    CommandLine|contains: 'do shell script'

  condition: selection

falsepositives:
  - Legitimate automation scripts use AppleScript do shell script for routine tasks; the underlying native API calls themselves are not visible at this telemetry layer.

level: low

Explore