Native API T1106

Events covered

20 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 58 rules share fields, values, and exclusions.

Fields filtered most (65 distinct)

These fields appear most often in rule filters.

Top indicator values (602 distinct)

These values appear most often in rule predicates.

Exclusions (683 distinct)

These values appear most often in top-level exclusions.

Rules under this technique

These vendors publish rules tagged with this technique.

Sigma 14 rules

• BPFDoor Abnormal Process ID or Lock File Accessed
• HackTool - CobaltStrike BOF Injection Pattern
• HackTool - HandleKatz Duplicating LSASS Handle
• HackTool - RedMimicry Winnti Playbook Execution
• HackTool - WinPwn Execution
• HackTool - WinPwn Execution - ScriptBlock
• Potential Binary Proxy Execution Via Cdb.EXE
• Potential Direct Syscall of NtOpenProcess
• Potential WinAPI Calls Via CommandLine
• Potential WinAPI Calls Via PowerShell Scripts
• Suspicious Mshta.EXE Execution Patterns
• Turla Group Named Pipes
• WinAPI Function Calls Via PowerShell Scripts
• WinAPI Library Calls Via PowerShell Scripts

Elastic 39 rules

• Abnormal Process ID or Lock File Created
• Egress Network Connection Followed by Memory File Descriptor Creation
• Egress Network Connection from Memory File Descriptor
• Execution of Memory File Descriptor via Interactive Session
• Execution of Memory File Descriptor via Suspicious Process
• File Creation or Modification via (Memory) File Descriptor
• In-Memory JXA Execution via ScriptingAdditions
• Loadable Kernel Module Load via Forked Memory File Descriptor
• LSASS Process Access via Windows API
• Memory File Descriptor Child Process Execution
• Memory File Descriptor Execution from Suspicious Process
• Memory File Descriptor Process Execution
• Native API Call from Unsigned Module
• Network Activity from Memory File Descriptor
• Network Activity via (Memory) File Descriptor
• Network Connection from Binary with RWX Memory Region
• Persistence via Hidden Run Key Detected
• Potential Credential Access via LSASS Memory Dump
• Potential Fileless Execution Sequence
• Potential Fileless Execution via Memory File Descriptor by LoLBin
• Potential Fileless Execution via Memory File Descriptor from Interpreter
• Potential Loadable Kernel Module Load via Memory File Descriptor
• Potential Memory File Descriptor Process Execution
• Potential Process Injection via dd
• Potential Process Injection via PowerShell
• PowerShell Kerberos Ticket Dump
• PowerShell Keylogging Script
• PowerShell PSReflect Script
• PowerShell Script with Token Impersonation Capabilities
• PowerShell Share Enumeration Script
• PowerShell Suspicious Discovery Related Windows API Functions
• PowerShell Suspicious Script with Audio Capture Capabilities
• Reflective Binary Load
• Reflective Dylib Load
• Suspicious Process Access via Direct System Call
• Suspicious SolarWinds Child Process
• Unknown Execution of Binary with RWX Memory Region
• User TCC DB Access by Osascript
• User TCC DB Access by Unsigned or Untrusted Process

Kusto 5 rules

• Dataverse - Suspicious use of Web API
• LSASS Dumping using Debug Privileges
• Powershell Empire Cmdlets Executed in Command Line
• Process Injection From Untrusted Process
• Suspicious VM Instance Creation Activity Detected