{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1106","id":"T1106","name":"Native API","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1106","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"2ffa941799142889f06002f0e550fb7d572b610f4ba7bd818d0f653045193794","description":"Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.\n\nAdversaries may abuse these OS API functions as a means of executing behaviors. Similar to [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system.\n\nNative API functions (such as <code>NtCreateProcess</code>) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.(Citation: OutFlank System Calls)(Citation: CyberBit System Calls)(Citation: MDSec System Calls) For example, functions such as the Windows API <code>CreateProcess()</code> or GNU <code>fork()</code> will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)\n\nHigher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation)\n\nAdversaries may use assembly to directly or in-directly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks.(Citation: Redops Syscalls) Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via [Disable or Modify Tools](https://attack.mitre.org/techniques/T1685).","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1106","external_id":"T1106"},{"source_name":"MACOS Cocoa","description":"Apple. (2015, September 16). Cocoa Application Layer. Retrieved June 25, 2020.","url":"https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/OSX_Technology_Overview/CocoaApplicationLayer/CocoaApplicationLayer.html#//apple_ref/doc/uid/TP40001067-CH274-SW1"},{"source_name":"Apple Core Services","description":"Apple. (n.d.). Core Services. Retrieved June 25, 2020.","url":"https://developer.apple.com/documentation/coreservices"},{"source_name":"macOS Foundation","description":"Apple. (n.d.). Foundation. Retrieved July 1, 2020.","url":"https://developer.apple.com/documentation/foundation"},{"source_name":"OutFlank System Calls","description":"de Plaa, C. (2019, June 19). Red Team Tactics: Combining Direct System Calls and sRDI to bypass AV/EDR. Retrieved September 29, 2021.","url":"https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/"},{"source_name":"Redops Syscalls","description":"Feichter, D. (2023, June 30). Direct Syscalls vs Indirect Syscalls. Retrieved September 27, 2023.","url":"https://redops.at/en/blog/direct-syscalls-vs-indirect-syscalls"},{"source_name":"GNU Fork","description":"Free Software Foundation, Inc.. (2020, June 18). Creating a Process. Retrieved June 25, 2020.","url":"https://www.gnu.org/software/libc/manual/html_node/Creating-a-Process.html"},{"source_name":"CyberBit System Calls","description":"Gavriel, H. (2018, November 27). Malware Mitigation when Direct System Calls are Used. Retrieved September 29, 2021.","url":"https://www.cyberbit.com/blog/endpoint-security/malware-mitigation-when-direct-system-calls-are-used/"},{"source_name":"GLIBC","description":"glibc developer community. (2020, February 1). The GNU C Library (glibc). Retrieved June 25, 2020.","url":"https://www.gnu.org/software/libc/"},{"source_name":"LIBC","description":"Kerrisk, M. (2016, December 12). libc(7) — Linux manual page. Retrieved June 25, 2020.","url":"https://man7.org/linux/man-pages//man7/libc.7.html"},{"source_name":"Linux Kernel API","description":"Linux Kernel Organization, Inc. (n.d.). The Linux Kernel API. Retrieved June 25, 2020.","url":"https://www.kernel.org/doc/html/v4.12/core-api/kernel-api.html"},{"source_name":"MDSec System Calls","description":"MDSec Research. (2020, December). Bypassing User-Mode Hooks and Direct Invocation of System Calls for Red Teams. Retrieved September 29, 2021.","url":"https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/"},{"source_name":"Microsoft CreateProcess","description":"Microsoft. (n.d.). CreateProcess function. Retrieved September 12, 2024.","url":"https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa"},{"source_name":"Microsoft Win32","description":"Microsoft. (n.d.). Programming reference for the Win32 API. Retrieved March 15, 2020.","url":"https://docs.microsoft.com/en-us/windows/win32/api/"},{"source_name":"Microsoft NET","description":"Microsoft. (n.d.). What is .NET Framework?. Retrieved March 15, 2020.","url":"https://dotnet.microsoft.com/learn/dotnet/what-is-dotnet-framework"},{"source_name":"NT API Windows","description":"The NTinterlnals.net team. (n.d.). Nowak, T. Retrieved June 25, 2020.","url":"https://undocumented.ntinternals.net/"}],"platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0035","name":"Process Access","page":"telemetry/DC0035/","kind":"attack_component","category":"Endpoint activity","description":"One process opening or accessing another process.","collection_focus":"Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["source_process_id","target_process_id","granted_access","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1106","id":"T1106","name":"Native API","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1106","technique_page":"techniques/enterprise/T1106/","page":"detections/enterprise/T1106/","status":"rule_source_available","counts":{"sigma":11,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"808146b2-9332-4d78-9416-d7e47012d83d","title":"BPFDoor Abnormal Process ID or Lock File Accessed","status":"test","level":"high","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/808146b2-9332-4d78-9416-d7e47012d83d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/path/lnx_auditd_bpfdoor_file_accessed.yml","author":"Rafal Piasecki","kind":"sigma"},{"id":"851fd622-b675-4d26-b803-14bc7baa517a","title":"HackTool - WinPwn Execution - ScriptBlock","status":"test","level":"high","logsource":{"category":"ps_script","product":"windows","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/851fd622-b675-4d26-b803-14bc7baa517a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml","author":"Swachchhanda Shrawan Poudel","kind":"sigma"},{"id":"03d83090-8cba-44a0-b02f-0b756a050306","title":"Potential WinAPI Calls Via PowerShell Scripts","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/03d83090-8cba-44a0-b02f-0b756a050306.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_win_api_susp_access.yml","author":"Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community","kind":"sigma"},{"id":"09706624-b7f6-455d-9d02-adee024cee1d","title":"HackTool - CobaltStrike BOF Injection Pattern","status":"test","level":"high","logsource":{"category":"process_access","product":"windows"},"data_path":"data/detection-rules/09706624-b7f6-455d-9d02-adee024cee1d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_access/proc_access_win_hktl_cobaltstrike_bof_injection_pattern.yml","author":"Christian Burkard (Nextron Systems)","kind":"sigma"},{"id":"b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5","title":"HackTool - HandleKatz Duplicating LSASS Handle","status":"test","level":"high","logsource":{"category":"process_access","product":"windows"},"data_path":"data/detection-rules/b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_access/proc_access_win_hktl_handlekatz_lsass_access.yml","author":"Bhabesh Raj (rule), @thefLinkk","kind":"sigma"},{"id":"3f3f3506-1895-401b-9cc3-e86b16e630d0","title":"Potential Direct Syscall of NtOpenProcess","status":"test","level":"medium","logsource":{"category":"process_access","product":"windows"},"data_path":"data/detection-rules/3f3f3506-1895-401b-9cc3-e86b16e630d0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_access/proc_access_win_susp_direct_ntopenprocess_call.yml","author":"Christian Burkard (Nextron Systems), Tim Shelton (FP)","kind":"sigma"},{"id":"b5c7395f-e501-4a08-94d4-57fe7a9da9d2","title":"Potential Binary Proxy Execution Via Cdb.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b5c7395f-e501-4a08-94d4-57fe7a9da9d2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_cdb_arbitrary_command_execution.yml","author":"Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"95022b85-ff2a-49fa-939a-d7b8f56eeb9b","title":"HackTool - RedMimicry Winnti Playbook Execution","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/95022b85-ff2a-49fa-939a-d7b8f56eeb9b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_redmimicry_winnti_playbook.yml","author":"Alexander Rausch","kind":"sigma"},{"id":"d557dc06-62e8-4468-a8e8-7984124908ce","title":"HackTool - WinPwn Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/d557dc06-62e8-4468-a8e8-7984124908ce.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_winpwn.yml","author":"Swachchhanda Shrawan Poudel","kind":"sigma"},{"id":"e32f92d1-523e-49c3-9374-bdb13b46a3ba","title":"Suspicious Mshta.EXE Execution Patterns","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e32f92d1-523e-49c3-9374-bdb13b46a3ba.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_mshta_susp_pattern.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"ba3f5c1b-6272-4119-9dbd-0bc8d21c2702","title":"Potential WinAPI Calls Via CommandLine","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ba3f5c1b-6272-4119-9dbd-0bc8d21c2702.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_inline_win_api_access.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0529","name":"Behavioral Detection of Native API Invocation via Unusual DLL Loads and Direct Syscalls","url":"https://attack.mitre.org/detectionstrategies/DET0529","stix_id":"x-mitre-detection-strategy--36654ec6-5019-4e79-b299-1fbf3a03e064","relationship_id":"relationship--dc9d1fc2-471b-49c3-b372-9703fd5125f4","description":"","analytics":[{"id":"AN1465","name":"Analytic 1465","guidance":"Unusual or suspicious processes loading critical native API DLLs (e.g., ntdll.dll, kernel32.dll) followed by direct syscall behavior, memory manipulation, or hollowing.","url":"https://attack.mitre.org/detectionstrategies/DET0529#AN1465","platforms":["Windows"],"tuning":[{"field":"DllName","description":"May tune DLL filters to focus on low-level API providers (e.g., ntdll.dll)"},{"field":"Image","description":"Tune for expected parent processes (e.g., explorer.exe, winlogon.exe)"},{"field":"TargetProcess","description":"Scope to suspicious targets like LSASS, csrss, etc."}],"log_sources":[{"component_id":"DC0016","component":"Module Load","name":"WinEventLog:Sysmon","channel":"EventCode=7","platforms":["Windows"],"analytic_id":"AN1465","source_url":"https://attack.mitre.org/detectionstrategies/DET0529#AN1465","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"},{"component_id":"DC0035","component":"Process Access","name":"WinEventLog:Sysmon","channel":"EventCode=10","platforms":["Windows"],"analytic_id":"AN1465","source_url":"https://attack.mitre.org/detectionstrategies/DET0529#AN1465","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1465","source_url":"https://attack.mitre.org/detectionstrategies/DET0529#AN1465","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN1466","name":"Analytic 1466","guidance":"Userland processes invoking syscall-heavy libraries (libc, glibc) followed by fork, mmap, or ptrace behavior commonly associated with code injection or memory manipulation.","url":"https://attack.mitre.org/detectionstrategies/DET0529#AN1466","platforms":["Linux"],"tuning":[{"field":"SyscallType","description":"Filter for fork, mmap, ptrace based on context"},{"field":"ProcessName","description":"Whitelist known daemon and scheduled task patterns"},{"field":"MAPS Path","description":"Tune suspicious memory map regions (e.g., /tmp/.evilshmem)"}],"log_sources":[{"component_id":"DC0035","component":"Process Access","name":"auditd:SYSCALL","channel":"execve, fork, mmap, ptrace","platforms":["Linux"],"analytic_id":"AN1466","source_url":"https://attack.mitre.org/detectionstrategies/DET0529#AN1466","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"},{"component_id":"DC0016","component":"Module Load","name":"auditd:SYSCALL","channel":"module load or memory map path","platforms":["Linux"],"analytic_id":"AN1466","source_url":"https://attack.mitre.org/detectionstrategies/DET0529#AN1466","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"}]},{"id":"AN1467","name":"Analytic 1467","guidance":"Execution of processes that link to CoreServices or Foundation APIs followed by creation of memory regions, code execution, or abnormal library injection.","url":"https://attack.mitre.org/detectionstrategies/DET0529#AN1467","platforms":["macOS"],"tuning":[{"field":"API Framework Name","description":"Filter on CoreServices, Cocoa, Foundation framework usage"},{"field":"Execution Context","description":"Tune to exclude known developer tools or test environments"}],"log_sources":[{"component_id":"DC0016","component":"Module Load","name":"macos:unifiedlog","channel":"launch and dylib load","platforms":["macOS"],"analytic_id":"AN1467","source_url":"https://attack.mitre.org/detectionstrategies/DET0529#AN1467","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_EXEC","platforms":["macOS"],"analytic_id":"AN1467","source_url":"https://attack.mitre.org/detectionstrategies/DET0529#AN1467","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]}]}],"telemetry_references":[{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0035","name":"Process Access","tag":"Process Access","page":"telemetry/DC0035/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S1087","name":"AsyncRAT","page":"tools/S1087/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0521","name":"BloodHound","page":"tools/S0521/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0695","name":"Donut","page":"tools/S0695/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0434","name":"Imminent Monitor","page":"tools/S0434/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1050","name":"PcShare","page":"tools/S1050/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0445","name":"ShimRatReporter","page":"tools/S0445/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S1087","name":"AsyncRAT","page":"tools/S1087/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0521","name":"BloodHound","page":"tools/S0521/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1063","name":"Brute Ratel C4","page":"tools/S1063/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0695","name":"Donut","page":"tools/S0695/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0434","name":"Imminent Monitor","page":"tools/S0434/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1050","name":"PcShare","page":"tools/S1050/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0445","name":"ShimRatReporter","page":"tools/S0445/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0011","name":"Taidoor","url":"https://attack.mitre.org/software/S0011","kind":"malware","description":"[Taidoor](https://attack.mitre.org/software/S0011) has the ability to use native APIs for execution including <code>GetProcessHeap</code>, <code>GetProcAddress</code>, and <code>LoadLibrary</code>.(Citation: TrendMicro Taidoor)(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)","relationship_id":"relationship--3502c424-9bf1-4780-a5bd-a0d3830e1251","references":[{"source_name":"TrendMicro Taidoor","description":"Trend Micro. (2012). The Taidoor Campaign. Retrieved November 12, 2014.","url":"http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf"},{"source_name":"CISA MAR-10292089-1.v2 TAIDOOR August 2021","description":"CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a"}]},{"id":"S0013","name":"PlugX","url":"https://attack.mitre.org/software/S0013","kind":"malware","description":"[PlugX](https://attack.mitre.org/software/S0013) can use the Windows API functions `GetProcAddress`, `LoadLibrary`, and `CreateProcess` to execute another process.(Citation: Eset PlugX Korplug Mustang Panda March 2022)(Citation: Proofpoint TA416 Europe March 2022)(Citation: Lastline PlugX Analysis)","relationship_id":"relationship--deafd60c-af1a-40eb-bc43-287b37553fae","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","description":"Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Proofpoint TA416 Europe March 2022","description":"Raggi, M. et al. (2022, March 7). The Good, the Bad, and the Web Bug: TA416 Increases Operational Tempo Against European Governments as Conflict in Ukraine Escalates. Retrieved March 16, 2022.","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source_name":"Lastline PlugX Analysis","description":"Vasilenko, R. (2013, December 17). An Analysis of PlugX Malware. Retrieved November 24, 2015.","url":"https://lastline3.rssing.com/chan-29044929/all_p1.html#c29044929a2"}]},{"id":"S0022","name":"Uroburos","url":"https://attack.mitre.org/software/S0022","kind":"malware","description":"[Uroburos](https://attack.mitre.org/software/S0022) can use native Windows APIs including `GetHostByName`.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)","relationship_id":"relationship--141a93b8-bfb7-4881-918c-7c91b7e41b25","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","description":"FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}]},{"id":"S0032","name":"gh0st RAT","url":"https://attack.mitre.org/software/S0032","kind":"malware","description":"[gh0st RAT](https://attack.mitre.org/software/S0032) has used the `InterlockedExchange`, `SeShutdownPrivilege`, and `ExitWindowsEx` Windows API functions.(Citation: Gh0stRAT ATT March 2019)","relationship_id":"relationship--9966a850-54b2-41f5-83de-51c066085d72","references":[{"source_name":"Gh0stRAT ATT March 2019","description":"Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020.","url":"https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant"}]},{"id":"S0045","name":"ADVSTORESHELL","url":"https://attack.mitre.org/software/S0045","kind":"malware","description":"[ADVSTORESHELL](https://attack.mitre.org/software/S0045) is capable of starting a process using CreateProcess.(Citation: Bitdefender APT28 Dec 2015)","relationship_id":"relationship--cc2099fb-4785-4884-b274-4f3e8a3b8d99","references":[{"source_name":"Bitdefender APT28 Dec 2015","description":"Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017.","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"}]},{"id":"S0083","name":"Misdat","url":"https://attack.mitre.org/software/S0083","kind":"malware","description":"[Misdat](https://attack.mitre.org/software/S0083) has used Windows APIs, including `ExitWindowsEx` and `GetKeyboardType`.(Citation: Cylance Dust Storm) ","relationship_id":"relationship--fdd7f2b3-08e4-4f55-ba94-4b5e6d619da8","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0084","name":"Mis-Type","url":"https://attack.mitre.org/software/S0084","kind":"malware","description":"[Mis-Type](https://attack.mitre.org/software/S0084) has used Windows API calls, including `NetUserAdd` and `NetUserDel`.(Citation: Cylance Dust Storm)","relationship_id":"relationship--07ec1906-e634-43d5-ba87-02054fe82da6","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0085","name":"S-Type","url":"https://attack.mitre.org/software/S0085","kind":"malware","description":"[S-Type](https://attack.mitre.org/software/S0085) has used Windows APIs, including `GetKeyboardType`, `NetUserAdd`, and `NetUserDel`.(Citation: Cylance Dust Storm)","relationship_id":"relationship--c7e8feda-58fd-4015-9525-9032fd0b8872","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0126","name":"ComRAT","url":"https://attack.mitre.org/software/S0126","kind":"malware","description":"[ComRAT](https://attack.mitre.org/software/S0126) can load a PE file from memory or the file system and execute it with <code>CreateProcessW</code>.(Citation: ESET ComRAT May 2020)","relationship_id":"relationship--7eaf474f-7755-41d7-96c6-811889457be2","references":[{"source_name":"ESET ComRAT May 2020","description":"Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"id":"S0128","name":"BADNEWS","url":"https://attack.mitre.org/software/S0128","kind":"malware","description":"[BADNEWS](https://attack.mitre.org/software/S0128) has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute.(Citation: Forcepoint Monsoon)(Citation: TrendMicro Patchwork Dec 2017)","relationship_id":"relationship--d15cda3e-7ed6-4914-a0a8-ff1f4fe668ec","references":[{"source_name":"Forcepoint Monsoon","description":"Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"},{"source_name":"TrendMicro Patchwork Dec 2017","description":"Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"id":"S0141","name":"Winnti for Windows","url":"https://attack.mitre.org/software/S0141","kind":"malware","description":"[Winnti for Windows](https://attack.mitre.org/software/S0141) can use Native API to create a new process and to start services.(Citation: Novetta Winnti April 2015)","relationship_id":"relationship--019e35b8-cec3-45e0-b297-19dca59b3190","references":[{"source_name":"Novetta Winnti April 2015","description":"Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017.","url":"https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"}]},{"id":"S0147","name":"Pteranodon","url":"https://attack.mitre.org/software/S0147","kind":"malware","description":"[Pteranodon](https://attack.mitre.org/software/S0147) has used various API calls.(Citation: Microsoft Actinium February 2022)","relationship_id":"relationship--20acec2a-ce61-4794-82f9-79fa778e7a7f","references":[{"source_name":"Microsoft Actinium February 2022","description":"Microsoft Threat Intelligence Center. (2022, February 4). ACTINIUM targets Ukrainian organizations. Retrieved February 18, 2022.","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"}]},{"id":"S0148","name":"RTM","url":"https://attack.mitre.org/software/S0148","kind":"malware","description":"[RTM](https://attack.mitre.org/software/S0148) can use the <code>FindNextUrlCacheEntryA</code> and <code>FindFirstUrlCacheEntryA</code> functions to search for specific strings within browser history.(Citation: ESET RTM Feb 2017)","relationship_id":"relationship--9ae8ed36-348a-4053-bfa2-81fd0cc774aa","references":[{"source_name":"ESET RTM Feb 2017","description":"Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"}]},{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154)'s Beacon payload is capable of running shell commands without <code>cmd.exe</code> and PowerShell commands without <code>powershell.exe</code>(Citation: cobaltstrike manual)(Citation: Talos Cobalt Strike September 2020)(Citation: Cobalt Strike Manual 4.3 November 2020) [Cobalt Strike](https://attack.mitre.org/software/S0154) can also use `CreateThreadpoolWait`, `SetThreadpoolWait`, and `MessageBoxA` for sandbox evasion and execution of embedded payloads in memory.(Citation: Cisco Talos Qilin Ransomware OCT 2025)","relationship_id":"relationship--095bfdd3-2379-4cad-bef4-53e8bdd08a75","references":[{"source_name":"Talos Cobalt Strike September 2020","description":"Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20210219195905/https://talos-intelligence-site.s3.amazonaws.com/production/document_files/files/000/095/031/original/Talos_Cobalt_Strike.pdf"},{"source_name":"cobaltstrike manual","description":"Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.","url":"https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","description":"Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"},{"source_name":"Cisco Talos Qilin Ransomware OCT 2025","description":"Takeda, T. et al. (2025, October 26). Uncovering Qilin attack methods exposed through multiple cases. Retrieved March 26, 2026.","url":"https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"}]},{"id":"S0161","name":"XAgentOSX","url":"https://attack.mitre.org/software/S0161","kind":"malware","description":"[XAgentOSX](https://attack.mitre.org/software/S0161) contains the execFile function to execute a specified file on the system using the NSTask:launch method.(Citation: XAgentOSX 2017)","relationship_id":"relationship--fc4811c4-103b-48b7-9e52-20d574cfc4bf","references":[{"source_name":"XAgentOSX 2017","description":"Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"}]},{"id":"S0180","name":"Volgmer","url":"https://attack.mitre.org/software/S0180","kind":"malware","description":"[Volgmer](https://attack.mitre.org/software/S0180) executes payloads using the Windows API call CreateProcessW().(Citation: US-CERT Volgmer 2 Nov 2017)","relationship_id":"relationship--4ed458b0-e5cd-48c7-baba-a33ca84a8738","references":[{"source_name":"US-CERT Volgmer 2 Nov 2017","description":"US-CERT. (2017, November 01). Malware Analysis Report (MAR) - 10135536-D. Retrieved July 16, 2018.","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-D_WHITE_S508C.PDF"}]},{"id":"S0198","name":"NETWIRE","url":"https://attack.mitre.org/software/S0198","kind":"malware","description":"[NETWIRE](https://attack.mitre.org/software/S0198) can use Native API including <code>CreateProcess</code> <code>GetProcessById</code>, and <code>WriteProcessMemory</code>.(Citation: FireEye NETWIRE March 2019)","relationship_id":"relationship--c2bfefa1-ccd3-4d8d-82d1-275507546de0","references":[{"source_name":"FireEye NETWIRE March 2019","description":"Maniath, S. and Kadam P. (2019, March 19). Dissecting a NETWIRE Phishing Campaign's Usage of Process Hollowing. Retrieved January 7, 2021.","url":"https://www.mandiant.com/resources/blog/dissecting-netwire-phishing-campaigns-usage-process-hollowing"}]},{"id":"S0234","name":"Bandook","url":"https://attack.mitre.org/software/S0234","kind":"malware","description":"[Bandook](https://attack.mitre.org/software/S0234) has used the ShellExecuteW() function call.(Citation: CheckPoint Bandook Nov 2020) ","relationship_id":"relationship--bd5fd2c2-a9a3-401e-8723-92df94f9c482","references":[{"source_name":"CheckPoint Bandook Nov 2020","description":"Check Point. (2020, November 26). Bandook: Signed & Delivered. Retrieved May 31, 2021.","url":"https://research.checkpoint.com/2020/bandook-signed-delivered/"}]},{"id":"S0239","name":"Bankshot","url":"https://attack.mitre.org/software/S0239","kind":"malware","description":"[Bankshot](https://attack.mitre.org/software/S0239) creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA().(Citation: McAfee Bankshot)","relationship_id":"relationship--70648d67-a2f5-4021-8ffe-3bbcdbe8e78f","references":[{"source_name":"McAfee Bankshot","description":"Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.","url":"https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"}]},{"id":"S0240","name":"ROKRAT","url":"https://attack.mitre.org/software/S0240","kind":"malware","description":"[ROKRAT](https://attack.mitre.org/software/S0240) can use a variety of API calls to execute shellcode.(Citation: Malwarebytes RokRAT VBA January 2021)","relationship_id":"relationship--44b2a372-1aee-4a7e-a544-2aacdfe3121a","references":[{"source_name":"Malwarebytes RokRAT VBA January 2021","description":"Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.","url":"https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"}]},{"id":"S0242","name":"SynAck","url":"https://attack.mitre.org/software/S0242","kind":"malware","description":"[SynAck](https://attack.mitre.org/software/S0242) parses the export tables of system DLLs to locate and call various Windows API functions.(Citation: SecureList SynAck Doppelgänging May 2018)(Citation: Kaspersky Lab SynAck May 2018)","relationship_id":"relationship--699e964d-b8c8-46fd-bd2d-9787433ab077","references":[{"source_name":"SecureList SynAck Doppelgänging May 2018","description":"Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.","url":"https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/"},{"source_name":"Kaspersky Lab SynAck May 2018","description":"Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.","url":"https://usa.kaspersky.com/about/press-releases/2018_synack-doppelganging"}]},{"id":"S0256","name":"Mosquito","url":"https://attack.mitre.org/software/S0256","kind":"malware","description":"[Mosquito](https://attack.mitre.org/software/S0256) leverages the CreateProcess() and LoadLibrary() calls to execute files with the .dll and .exe extensions.(Citation: ESET Turla Mosquito Jan 2018)","relationship_id":"relationship--eda49ac0-3077-4bff-9b30-44f527914e9c","references":[{"source_name":"ESET Turla Mosquito Jan 2018","description":"ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"}]},{"id":"S0259","name":"InnaputRAT","url":"https://attack.mitre.org/software/S0259","kind":"malware","description":"[InnaputRAT](https://attack.mitre.org/software/S0259) uses the API call ShellExecuteW for execution.(Citation: ASERT InnaputRAT April 2018)","relationship_id":"relationship--7af9715f-b85c-4fc5-8ef8-5884c8144178","references":[{"source_name":"ASERT InnaputRAT April 2018","description":"ASERT Team. (2018, April 04). Innaput Actors Utilize Remote Access Trojan Since 2016, Presumably Targeting Victim Files. Retrieved July 9, 2018.","url":"https://asert.arbornetworks.com/innaput-actors-utilize-remote-access-trojan-since-2016-presumably-targeting-victim-files/"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) can use winapiexec tool for indirect execution of  <code>ShellExecuteW</code> and <code>CreateProcessA</code>.(Citation: ESET InvisiMole June 2020)","relationship_id":"relationship--fd93333d-ec77-4f0d-be90-64860d67bdf5","references":[{"source_name":"ESET InvisiMole June 2020","description":"Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}]},{"id":"S0266","name":"TrickBot","url":"https://attack.mitre.org/software/S0266","kind":"malware","description":"[TrickBot](https://attack.mitre.org/software/S0266) uses the Windows API call, CreateProcessW(), to manage execution flow.(Citation: S2 Grupo TrickBot June 2017) [TrickBot](https://attack.mitre.org/software/S0266) has also used <code>Nt*</code> API functions to perform [Process Injection](https://attack.mitre.org/techniques/T1055).(Citation: Joe Sec Trickbot)","relationship_id":"relationship--2af126e3-89ef-45b4-b345-45567ef17dfa","references":[{"source_name":"S2 Grupo TrickBot June 2017","description":"Salinas, M., Holguin, J. (2017, June). Evolution of Trickbot. Retrieved July 31, 2018.","url":"https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf"},{"source_name":"Joe Sec Trickbot","description":"Joe Security. (2020, July 13). TrickBot's new API-Hammering explained. Retrieved September 30, 2021.","url":"https://www.joesecurity.org/blog/498839998833561473"}]},{"id":"S0268","name":"Bisonal","url":"https://attack.mitre.org/software/S0268","kind":"malware","description":"[Bisonal](https://attack.mitre.org/software/S0268) has used the Windows API to communicate with the Service Control Manager to execute a thread.(Citation: Talos Bisonal Mar 2020)","relationship_id":"relationship--06808653-60ba-430a-8c37-b3b49d740578","references":[{"source_name":"Talos Bisonal Mar 2020","description":"Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}]},{"id":"S0354","name":"Denis","url":"https://attack.mitre.org/software/S0354","kind":"malware","description":"[Denis](https://attack.mitre.org/software/S0354) used the <code>IsDebuggerPresent</code>, <code>OutputDebugString</code>, and <code>SetLastError</code> APIs to avoid debugging. [Denis](https://attack.mitre.org/software/S0354) used <code>GetProcAddress</code> and <code>LoadLibrary</code> to dynamically resolve APIs. [Denis](https://attack.mitre.org/software/S0354) also used the <code>Wow64SetThreadContext</code> API as part of a process hollowing process.(Citation: Cybereason Cobalt Kitty 2017)\t","relationship_id":"relationship--a51caaf6-3b9d-4953-9850-bf9217877644","references":[{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"S0356","name":"KONNI","url":"https://attack.mitre.org/software/S0356","kind":"malware","description":"[KONNI](https://attack.mitre.org/software/S0356) has hardcoded API calls within its functions to use on the victim's machine.(Citation: Malwarebytes Konni Aug 2021) ","relationship_id":"relationship--9187cbc8-c0b5-440b-b10a-226684e968fc","references":[{"source_name":"Malwarebytes Konni Aug 2021","description":"Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"}]},{"id":"S0363","name":"Empire","url":"https://attack.mitre.org/software/S0363","kind":"tool","description":"[Empire](https://attack.mitre.org/software/S0363) contains a variety of enumeration modules that have an option to use API calls to carry out tasks.(Citation: Github PowerShell Empire)","relationship_id":"relationship--8362d7e2-c22a-4bde-99dd-b2d66b4c775a","references":[{"source_name":"Github PowerShell Empire","description":"Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.","url":"https://github.com/PowerShellEmpire/Empire"}]},{"id":"S0367","name":"Emotet","url":"https://attack.mitre.org/software/S0367","kind":"malware","description":"[Emotet](https://attack.mitre.org/software/S0367) has used `CreateProcess` to create a new process to run its executable and `WNetEnumResourceW` to enumerate non-hidden shares.(Citation: Binary Defense Emotes Wi-Fi Spreader)","relationship_id":"relationship--fba17e05-d7dd-4944-97c8-7771d6b833fb","references":[{"source_name":"Binary Defense Emotes Wi-Fi Spreader","description":"Binary Defense. (n.d.). Emotet Evolves With new Wi-Fi Spreader. Retrieved September 8, 2023.","url":"https://www.binarydefense.com/resources/blog/emotet-evolves-with-new-wi-fi-spreader/"}]},{"id":"S0384","name":"Dridex","url":"https://attack.mitre.org/software/S0384","kind":"malware","description":"[Dridex](https://attack.mitre.org/software/S0384) has used the <code>OutputDebugStringW</code> function to avoid malware analysis as part of its anti-debugging technique.(Citation: Checkpoint Dridex Jan 2021) ","relationship_id":"relationship--19e06de9-b9a1-4532-94c6-f729036ba0c3","references":[{"source_name":"Checkpoint Dridex Jan 2021","description":"Check Point Research. (2021, January 4). Stopping Serial Killer: Catching the Next Strike. Retrieved September 7, 2021.","url":"https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/"}]},{"id":"S0385","name":"njRAT","url":"https://attack.mitre.org/software/S0385","kind":"malware","description":"[njRAT](https://attack.mitre.org/software/S0385) has used the ShellExecute() function within a script.(Citation: Trend Micro njRAT 2018)","relationship_id":"relationship--48879c97-651c-4426-9093-bd8c4939fc19","references":[{"source_name":"Trend Micro njRAT 2018","description":"Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/"}]},{"id":"S0386","name":"Ursnif","url":"https://attack.mitre.org/software/S0386","kind":"malware","description":"[Ursnif](https://attack.mitre.org/software/S0386) has used <code>CreateProcessW</code> to create child processes.(Citation: FireEye Ursnif Nov 2017)","relationship_id":"relationship--1eb02abf-4bad-4672-a0dd-73fffc02bb47","references":[{"source_name":"FireEye Ursnif Nov 2017","description":"Vaish, A. & Nemes, S. (2017, November 28). Newly Observed Ursnif Variant Employs Malicious TLS Callback Technique to Achieve Process Injection. Retrieved June 5, 2019.","url":"https://www.fireeye.com/blog/threat-research/2017/11/ursnif-variant-malicious-tls-callback-technique.html"}]},{"id":"S0391","name":"HAWKBALL","url":"https://attack.mitre.org/software/S0391","kind":"malware","description":"[HAWKBALL](https://attack.mitre.org/software/S0391) has leveraged several Windows API calls to create processes, gather disk information, and detect debugger activity.(Citation: FireEye HAWKBALL Jun 2019)","relationship_id":"relationship--ec61cd5f-b6aa-4aee-acb2-2882b8914c68","references":[{"source_name":"FireEye HAWKBALL Jun 2019","description":"Patil, S. and Williams, M.. (2019, June 5). Government Sector in Central Asia Targeted With New HAWKBALL Backdoor Delivered via Microsoft Office Vulnerabilities. Retrieved June 20, 2019.","url":"https://www.fireeye.com/blog/threat-research/2019/06/government-in-central-asia-targeted-with-hawkball-backdoor.html"}]},{"id":"S0395","name":"LightNeuron","url":"https://attack.mitre.org/software/S0395","kind":"malware","description":"[LightNeuron](https://attack.mitre.org/software/S0395) is capable of starting a process using CreateProcess.(Citation: ESET LightNeuron May 2019)","relationship_id":"relationship--abf45442-6ca3-4538-ad21-db2e46f43f67","references":[{"source_name":"ESET LightNeuron May 2019","description":"Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf"}]},{"id":"S0396","name":"EvilBunny","url":"https://attack.mitre.org/software/S0396","kind":"malware","description":"[EvilBunny](https://attack.mitre.org/software/S0396) has used various API calls as part of its checks to see if the malware is running in a sandbox.(Citation: Cyphort EvilBunny Dec 2014)\t","relationship_id":"relationship--00ba134e-1833-4dde-bf4e-7ec45271e8a6","references":[{"source_name":"Cyphort EvilBunny Dec 2014","description":"Marschalek, M.. (2014, December 16). EvilBunny: Malware Instrumented By Lua. Retrieved June 28, 2019.","url":"https://web.archive.org/web/20150311013500/http://www.cyphort.com/evilbunny-malware-instrumented-lua/"}]},{"id":"S0398","name":"HyperBro","url":"https://attack.mitre.org/software/S0398","kind":"malware","description":"[HyperBro](https://attack.mitre.org/software/S0398) has the ability to run an application (<code>CreateProcessW</code>) or script/file (<code>ShellExecuteW</code>) via API.(Citation: Unit42 Emissary Panda May 2019)","relationship_id":"relationship--bc8cb83f-fc66-4c44-8d60-f6f4be4b4f41","references":[{"source_name":"Unit42 Emissary Panda May 2019","description":"Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019.","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"}]},{"id":"S0412","name":"ZxShell","url":"https://attack.mitre.org/software/S0412","kind":"malware","description":"[ZxShell](https://attack.mitre.org/software/S0412) can leverage native API including <code>RegisterServiceCtrlHandler </code> to register a service.RegisterServiceCtrlHandler ","relationship_id":"relationship--eb7db180-08e0-4240-a1d4-b520fbe4dc8c","references":[]},{"id":"S0416","name":"RDFSNIFFER","url":"https://attack.mitre.org/software/S0416","kind":"malware","description":"[RDFSNIFFER](https://attack.mitre.org/software/S0416) has used several Win32 API functions to interact with the victim machine.(Citation: FireEye FIN7 Oct 2019)","relationship_id":"relationship--bcd66737-6beb-4cf8-9ba1-8a32731d1da1","references":[{"source_name":"FireEye FIN7 Oct 2019","description":"Carr, N, et all. (2019, October 10). Mahalo FIN7: Responding to the Criminal Operators’ New Tools and Techniques. Retrieved October 11, 2019.","url":"https://www.fireeye.com/blog/threat-research/2019/10/mahalo-fin7-responding-to-new-tools-and-techniques.html"}]},{"id":"S0431","name":"HotCroissant","url":"https://attack.mitre.org/software/S0431","kind":"malware","description":"[HotCroissant](https://attack.mitre.org/software/S0431) can perform dynamic DLL importing and API lookups using <code>LoadLibrary</code> and <code>GetProcAddress</code> on obfuscated strings.(Citation: US-CERT HOTCROISSANT February 2020)","relationship_id":"relationship--7066827b-795c-447c-9c07-05765ed1e07b","references":[{"source_name":"US-CERT HOTCROISSANT February 2020","description":"US-CERT. (2020, February 20). MAR-10271944-1.v1 – North Korean Trojan: HOTCROISSANT. Retrieved May 1, 2020.","url":"https://www.us-cert.gov/ncas/analysis-reports/ar20-045d"}]},{"id":"S0434","name":"Imminent Monitor","url":"https://attack.mitre.org/software/S0434","kind":"tool","description":"[Imminent Monitor](https://attack.mitre.org/software/S0434) has leveraged CreateProcessW() call to execute the debugger.(Citation: QiAnXin APT-C-36 Feb2019)","relationship_id":"relationship--106cf74b-91d6-4348-91ae-48d1a42abb73","references":[{"source_name":"QiAnXin APT-C-36 Feb2019","description":"QiAnXin Threat Intelligence Center. (2019, February 18). APT-C-36: Continuous Attacks Targeting Colombian Government Institutions and Corporations. Retrieved May 5, 2020.","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}]},{"id":"S0435","name":"PLEAD","url":"https://attack.mitre.org/software/S0435","kind":"malware","description":"[PLEAD](https://attack.mitre.org/software/S0435) can use `ShellExecute` to execute applications.(Citation: TrendMicro BlackTech June 2017)","relationship_id":"relationship--c587fc65-b591-4a23-bb5a-f2971c427ba0","references":[{"source_name":"TrendMicro BlackTech June 2017","description":"Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech’s Cyber Espionage Campaigns. Retrieved May 5, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}]},{"id":"S0438","name":"Attor","url":"https://attack.mitre.org/software/S0438","kind":"malware","description":"[Attor](https://attack.mitre.org/software/S0438)'s dispatcher has used CreateProcessW API for execution.(Citation: ESET Attor Oct 2019)","relationship_id":"relationship--f0a78f8e-9d04-40d7-b0ce-6a463af4b8e1","references":[{"source_name":"ESET Attor Oct 2019","description":"Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}]},{"id":"S0444","name":"ShimRat","url":"https://attack.mitre.org/software/S0444","kind":"malware","description":"[ShimRat](https://attack.mitre.org/software/S0444) has used Windows API functions to install the service and shim.(Citation: FOX-IT May 2016 Mofang)\t","relationship_id":"relationship--bdd7c955-c41a-4b68-9eb6-1ecd66869457","references":[{"source_name":"FOX-IT May 2016 Mofang","description":"Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]},{"id":"S0445","name":"ShimRatReporter","url":"https://attack.mitre.org/software/S0445","kind":"tool","description":"[ShimRatReporter](https://attack.mitre.org/software/S0445) used several Windows API functions to gather information from the infected system.(Citation: FOX-IT May 2016 Mofang)","relationship_id":"relationship--f5ced467-529f-4ce2-9f30-6a4a80565e87","references":[{"source_name":"FOX-IT May 2016 Mofang","description":"Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]},{"id":"S0446","name":"Ryuk","url":"https://attack.mitre.org/software/S0446","kind":"malware","description":"[Ryuk](https://attack.mitre.org/software/S0446) has used multiple native APIs including <code>ShellExecuteW</code> to run executables,<code>GetWindowsDirectoryW</code> to create folders, and <code>VirtualAlloc</code>, <code>WriteProcessMemory</code>, and <code>CreateRemoteThread</code> for process injection.(Citation: CrowdStrike Ryuk January 2019)","relationship_id":"relationship--1790f5a1-b5d5-41a4-8da0-c75ed7a23b0d","references":[{"source_name":"CrowdStrike Ryuk January 2019","description":"Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.","url":"https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"}]},{"id":"S0447","name":"Lokibot","url":"https://attack.mitre.org/software/S0447","kind":"malware","description":"[Lokibot](https://attack.mitre.org/software/S0447) has used LoadLibrary(), GetProcAddress() and CreateRemoteThread() API functions to execute its shellcode.(Citation: Talos Lokibot Jan 2021)","relationship_id":"relationship--ab90bb4c-96d2-4c01-ac66-fe8bf585d88c","references":[{"source_name":"Talos Lokibot Jan 2021","description":"Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.","url":"https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html"}]},{"id":"S0448","name":"Rising Sun","url":"https://attack.mitre.org/software/S0448","kind":"malware","description":"[Rising Sun](https://attack.mitre.org/software/S0448) used dynamic API resolutions to various Windows APIs by leveraging `LoadLibrary()` and `GetProcAddress()`.(Citation: McAfee Sharpshooter December 2018)","relationship_id":"relationship--ed3539fa-7ae7-45b0-9f0f-d62460ed07b1","references":[{"source_name":"McAfee Sharpshooter December 2018","description":"Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"}]},{"id":"S0449","name":"Maze","url":"https://attack.mitre.org/software/S0449","kind":"malware","description":"[Maze](https://attack.mitre.org/software/S0449) has used several Windows API functions throughout the encryption process including IsDebuggerPresent, TerminateProcess, Process32FirstW, among others.(Citation: McAfee Maze March 2020)\t","relationship_id":"relationship--6e4d32b9-923f-46a9-887e-4d4d0687fd1b","references":[{"source_name":"McAfee Maze March 2020","description":"Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/"}]},{"id":"S0453","name":"Pony","url":"https://attack.mitre.org/software/S0453","kind":"malware","description":"[Pony](https://attack.mitre.org/software/S0453) has used several Windows functions for various purposes.(Citation: Malwarebytes Pony April 2016)\t","relationship_id":"relationship--02075984-9bec-465e-8a21-6717b9a1308b","references":[{"source_name":"Malwarebytes Pony April 2016","description":"hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.","url":"https://blog.malwarebytes.com/threat-analysis/2015/11/no-money-but-pony-from-a-mail-to-a-trojan-horse/"}]},{"id":"S0455","name":"Metamorfo","url":"https://attack.mitre.org/software/S0455","kind":"malware","description":"[Metamorfo](https://attack.mitre.org/software/S0455) has used native WINAPI calls.(Citation: Medium Metamorfo Apr 2020)(Citation: Fortinet Metamorfo Feb 2020)","relationship_id":"relationship--3c132a1b-053d-450b-8a4f-cabf30317075","references":[{"source_name":"Medium Metamorfo Apr 2020","description":"Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.","url":"https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767"},{"source_name":"Fortinet Metamorfo Feb 2020","description":"Zhang, X. (2020, February 4). Another Metamorfo Variant Targeting Customers of Financial Institutions in More Countries. Retrieved July 30, 2020.","url":"https://www.fortinet.com/blog/threat-research/another-metamorfo-variant-targeting-customers-of-financial-institutions"}]},{"id":"S0456","name":"Aria-body","url":"https://attack.mitre.org/software/S0456","kind":"malware","description":"[Aria-body](https://attack.mitre.org/software/S0456) has the ability to launch files using <code>ShellExecute</code>.(Citation: CheckPoint Naikon May 2020)","relationship_id":"relationship--1681f4aa-4bb1-482a-8fdf-8c1b724635d9","references":[{"source_name":"CheckPoint Naikon May 2020","description":"CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}]},{"id":"S0457","name":"Netwalker","url":"https://attack.mitre.org/software/S0457","kind":"malware","description":"[Netwalker](https://attack.mitre.org/software/S0457) can use Windows API functions to inject the ransomware DLL.(Citation: TrendMicro Netwalker May 2020)","relationship_id":"relationship--aa045472-7c41-49c5-af44-4df9cf1fa073","references":[{"source_name":"TrendMicro Netwalker May 2020","description":"Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/"}]},{"id":"S0458","name":"Ramsay","url":"https://attack.mitre.org/software/S0458","kind":"malware","description":"[Ramsay](https://attack.mitre.org/software/S0458) can use Windows API functions such as <code>WriteFile</code>, <code>CloseHandle</code>, and <code>GetCurrentHwProfile</code> during its collection and file storage operations. [Ramsay](https://attack.mitre.org/software/S0458) can execute its embedded components via <code>CreateProcessA</code> and <code>ShellExecute</code>.(Citation: Eset Ramsay May 2020)","relationship_id":"relationship--239eb918-b9e0-499c-9934-96382fa782a0","references":[{"source_name":"Eset Ramsay May 2020","description":"Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"}]},{"id":"S0466","name":"WindTail","url":"https://attack.mitre.org/software/S0466","kind":"malware","description":"[WindTail](https://attack.mitre.org/software/S0466) can invoke Apple APIs <code>contentsOfDirectoryAtPath</code>, <code>pathExtension</code>, and (string) <code>compare</code>.(Citation: objective-see windtail2 jan 2019)","relationship_id":"relationship--1e669c57-11e8-4088-904c-84940458be8e","references":[{"source_name":"objective-see windtail2 jan 2019","description":"Wardle, Patrick. (2019, January 15). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 2). Retrieved October 3, 2019.","url":"https://objective-see.com/blog/blog_0x3D.html"}]},{"id":"S0470","name":"BBK","url":"https://attack.mitre.org/software/S0470","kind":"malware","description":"[BBK](https://attack.mitre.org/software/S0470) has the ability to use the <code>CreatePipe</code> API to add a sub-process for execution via [cmd](https://attack.mitre.org/software/S0106).(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--f8f24599-854a-4795-891b-c28d89b8ddcc","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"S0471","name":"build_downer","url":"https://attack.mitre.org/software/S0471","kind":"malware","description":"[build_downer](https://attack.mitre.org/software/S0471) has the ability to use the <code>WinExec</code> API to execute malware on a compromised host.(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--419b786c-a7db-4357-918c-aa1b883203ee","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"S0475","name":"BackConfig","url":"https://attack.mitre.org/software/S0475","kind":"malware","description":"[BackConfig](https://attack.mitre.org/software/S0475) can leverage API functions such as <code>ShellExecuteA</code> and <code>HttpOpenRequestA</code> in the process of downloading and executing files.(Citation: Unit 42 BackConfig May 2020)","relationship_id":"relationship--1c0296de-dc33-4fd7-b774-1bbe8c1b56b7","references":[{"source_name":"Unit 42 BackConfig May 2020","description":"Hinchliffe, A. and Falcone, R. (2020, May 11). Updated BackConfig Malware Targeting Government and Military Organizations in South Asia. Retrieved June 17, 2020.","url":"https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"}]},{"id":"S0477","name":"Goopy","url":"https://attack.mitre.org/software/S0477","kind":"malware","description":"[Goopy](https://attack.mitre.org/software/S0477) has the ability to  enumerate the infected system's user name via <code>GetUserNameW</code>.(Citation: Cybereason Cobalt Kitty 2017)","relationship_id":"relationship--c6c9fa0e-988e-4c14-a30f-d6576572a2d9","references":[{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"S0483","name":"IcedID","url":"https://attack.mitre.org/software/S0483","kind":"malware","description":"[IcedID](https://attack.mitre.org/software/S0483) has called <code>ZwWriteVirtualMemory</code>, <code>ZwProtectVirtualMemory</code>, <code>ZwQueueApcThread</code>, and <code>NtResumeThread</code> to inject itself into a remote process.(Citation: Juniper IcedID June 2020)","relationship_id":"relationship--891f37e3-9c72-4eed-8fcc-8106dc360a97","references":[{"source_name":"Juniper IcedID June 2020","description":"Kimayong, P. (2020, June 18). COVID-19 and FMLA Campaigns used to install new IcedID banking malware. Retrieved July 14, 2020.","url":"https://blogs.juniper.net/en-us/threat-research/covid-19-and-fmla-campaigns-used-to-install-new-icedid-banking-malware"}]},{"id":"S0484","name":"Carberp","url":"https://attack.mitre.org/software/S0484","kind":"malware","description":"[Carberp](https://attack.mitre.org/software/S0484) has used the NtQueryDirectoryFile and ZwQueryDirectoryFile functions to hide files and directories.(Citation: Trusteer Carberp October 2010)","relationship_id":"relationship--caa542d3-c8b0-4d10-998d-0998be406da8","references":[{"source_name":"Trusteer Carberp October 2010","description":"Trusteer Fraud Prevention Center. (2010, October 7). Carberp Under the Hood of Carberp: Malware & Configuration Analysis. Retrieved July 15, 2020.","url":"https://web.archive.org/web/20111004014029/http://www.trusteer.com/sites/default/files/Carberp_Analysis.pdf"}]},{"id":"S0493","name":"GoldenSpy","url":"https://attack.mitre.org/software/S0493","kind":"malware","description":"[GoldenSpy](https://attack.mitre.org/software/S0493) can execute remote commands in the Windows command shell using the <code>WinExec()</code> API.(Citation: Trustwave GoldenSpy June 2020)\t","relationship_id":"relationship--7b9bc78d-87b4-46a7-a5f9-73060535c47d","references":[{"source_name":"Trustwave GoldenSpy June 2020","description":"Trustwave SpiderLabs. (2020, June 25). The Golden Tax Department and Emergence of GoldenSpy Malware. Retrieved July 23, 2020.","url":"https://www.trustwave.com/en-us/resources/library/documents/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/"}]},{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"[REvil](https://attack.mitre.org/software/S0496) can use Native API for execution and to retrieve active services.(Citation: Secureworks REvil September 2019)(Citation: Intel 471 REvil March 2020)","relationship_id":"relationship--63131350-3239-4272-a155-5d50e174b1e3","references":[{"source_name":"Secureworks REvil September 2019","description":"Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"},{"source_name":"Intel 471 REvil March 2020","description":"Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.","url":"https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"}]},{"id":"S0499","name":"Hancitor","url":"https://attack.mitre.org/software/S0499","kind":"malware","description":"[Hancitor](https://attack.mitre.org/software/S0499) has used <code>CallWindowProc</code> and <code>EnumResourceTypesA</code> to interpret and execute shellcode.(Citation: FireEye Hancitor)","relationship_id":"relationship--51fb8815-6f59-46ff-8f7a-98025623db76","references":[{"source_name":"FireEye Hancitor","description":"Anubhav, A., Jallepalli, D. (2016, September 23). Hancitor (AKA Chanitor) observed using multiple attack approaches. Retrieved August 13, 2020.","url":"https://www.fireeye.com/blog/threat-research/2016/09/hancitor_aka_chanit.html"}]},{"id":"S0501","name":"PipeMon","url":"https://attack.mitre.org/software/S0501","kind":"malware","description":"[PipeMon](https://attack.mitre.org/software/S0501)'s first stage has been executed by a call to <code>CreateProcess</code> with the decryption password in an argument. [PipeMon](https://attack.mitre.org/software/S0501) has used a call to <code>LoadLibrary</code> to load its installer.(Citation: ESET PipeMon May 2020)","relationship_id":"relationship--dfea8f12-5c47-4a11-a4ed-06d08192b9ab","references":[{"source_name":"ESET PipeMon May 2020","description":"Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.","url":"https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"}]},{"id":"S0512","name":"FatDuke","url":"https://attack.mitre.org/software/S0512","kind":"malware","description":"[FatDuke](https://attack.mitre.org/software/S0512) can call <code>ShellExecuteW</code> to open the default browser on the URL localhost.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--67c21ae7-5dc3-4439-b5d1-df937abac3ad","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0517","name":"Pillowmint","url":"https://attack.mitre.org/software/S0517","kind":"malware","description":"[Pillowmint](https://attack.mitre.org/software/S0517) has used multiple native Windows APIs to execute and conduct process injections.(Citation: Trustwave Pillowmint June 2020)","relationship_id":"relationship--9ac9325d-067d-4936-9c8d-159e21bd04c4","references":[{"source_name":"Trustwave Pillowmint June 2020","description":"Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/"}]},{"id":"S0518","name":"PolyglotDuke","url":"https://attack.mitre.org/software/S0518","kind":"malware","description":"[PolyglotDuke](https://attack.mitre.org/software/S0518) can use <code>LoadLibraryW</code> and <code>CreateProcess</code> to load and execute code.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--630d1f21-549f-415a-968c-bd3dc3c6fb7f","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0521","name":"BloodHound","url":"https://attack.mitre.org/software/S0521","kind":"tool","description":"[BloodHound](https://attack.mitre.org/software/S0521) can use .NET API calls in the SharpHound ingestor component to pull Active Directory data.(Citation: GitHub Bloodhound)","relationship_id":"relationship--8d512a95-702d-4670-ab33-069552494102","references":[{"source_name":"GitHub Bloodhound","description":"Robbins, A., Vazarkar, R., and Schroeder, W. (2016, April 17). Bloodhound: Six Degrees of Domain Admin. Retrieved March 5, 2019.","url":"https://github.com/BloodHoundAD/BloodHound"}]},{"id":"S0531","name":"Grandoreiro","url":"https://attack.mitre.org/software/S0531","kind":"malware","description":"[Grandoreiro](https://attack.mitre.org/software/S0531) can execute through the <code>WinExec</code> API.(Citation: ESET Grandoreiro April 2020)","relationship_id":"relationship--d06c864f-e4b8-484d-8e75-76a480509665","references":[{"source_name":"ESET Grandoreiro April 2020","description":"ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.","url":"https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"}]},{"id":"S0534","name":"Bazar","url":"https://attack.mitre.org/software/S0534","kind":"malware","description":"[Bazar](https://attack.mitre.org/software/S0534) can use various APIs to allocate memory and facilitate code execution/injection.(Citation: Cybereason Bazar July 2020)","relationship_id":"relationship--ea40d7a0-bb12-4ed1-a5bd-efdc6bdad4b2","references":[{"source_name":"Cybereason Bazar July 2020","description":"Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"}]},{"id":"S0537","name":"HyperStack","url":"https://attack.mitre.org/software/S0537","kind":"malware","description":"[HyperStack](https://attack.mitre.org/software/S0537) can use Windows API's <code>ConnectNamedPipe</code> and <code>WNetAddConnection2</code> to detect incoming connections and connect to remote shares.(Citation: Accenture HyperStack October 2020)","relationship_id":"relationship--6cf502c8-58c4-41d5-abb1-f97492b1341c","references":[{"source_name":"Accenture HyperStack October 2020","description":"Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.","url":"https://web.archive.org/web/20201101015247/https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity"}]},{"id":"S0554","name":"Egregor","url":"https://attack.mitre.org/software/S0554","kind":"malware","description":"[Egregor](https://attack.mitre.org/software/S0554) has used the Windows API to make detection more difficult.(Citation: Cyble Egregor Oct 2020) ","relationship_id":"relationship--5bcec016-2150-4c45-9e9b-228838c9e843","references":[{"source_name":"Cyble Egregor Oct 2020","description":"Cybleinc. (2020, October 31). Egregor Ransomware – A Deep Dive Into Its Activities and Techniques. Retrieved December 29, 2020.","url":"https://cybleinc.com/2020/10/31/egregor-ransomware-a-deep-dive-into-its-activities-and-techniques/"}]},{"id":"S0561","name":"GuLoader","url":"https://attack.mitre.org/software/S0561","kind":"malware","description":"[GuLoader](https://attack.mitre.org/software/S0561) can use a number of different APIs for discovery and execution.(Citation: Medium Eli Salem GuLoader April 2021)","relationship_id":"relationship--5849f602-f706-4ab3-84e1-44ee1a923ba9","references":[{"source_name":"Medium Eli Salem GuLoader April 2021","description":"Salem, E. (2021, April 19). Dancing With Shellcodes: Cracking the latest version of Guloader. Retrieved July 7, 2021.","url":"https://elis531989.medium.com/dancing-with-shellcodes-cracking-the-latest-version-of-guloader-75083fb15cb4"}]},{"id":"S0562","name":"SUNSPOT","url":"https://attack.mitre.org/software/S0562","kind":"malware","description":"[SUNSPOT](https://attack.mitre.org/software/S0562) used Windows API functions such as <code>MoveFileEx</code> and <code>NtQueryInformationProcess</code> as part of the [SUNBURST](https://attack.mitre.org/software/S0559) injection process.(Citation: CrowdStrike SUNSPOT Implant January 2021) ","relationship_id":"relationship--9b59a1db-0b3d-4ce7-9cea-d91a71dd0a57","references":[{"source_name":"CrowdStrike SUNSPOT Implant January 2021","description":"CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021.","url":"https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"}]},{"id":"S0569","name":"Explosive","url":"https://attack.mitre.org/software/S0569","kind":"malware","description":"[Explosive](https://attack.mitre.org/software/S0569) has a function to call the OpenClipboard wrapper.(Citation: CheckPoint Volatile Cedar March 2015)  ","relationship_id":"relationship--afcc8ef7-cc5e-4e3b-a430-acafb12f5844","references":[{"source_name":"CheckPoint Volatile Cedar March 2015","description":"Threat Intelligence and Research. (2015, March 30). VOLATILE CEDAR. Retrieved February 8, 2021.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf"}]},{"id":"S0570","name":"BitPaymer","url":"https://attack.mitre.org/software/S0570","kind":"malware","description":"[BitPaymer](https://attack.mitre.org/software/S0570) has used dynamic API resolution to avoid identifiable strings within the binary, including <code>RegEnumKeyW</code>.(Citation: Crowdstrike Indrik November 2018)","relationship_id":"relationship--f66247c0-1d4b-475b-8336-04530edb1455","references":[{"source_name":"Crowdstrike Indrik November 2018","description":"Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"}]},{"id":"S0574","name":"BendyBear","url":"https://attack.mitre.org/software/S0574","kind":"malware","description":"[BendyBear](https://attack.mitre.org/software/S0574) can load and execute modules and Windows Application Programming (API) calls using standard shellcode API hashing.(Citation: Unit42 BendyBear Feb 2021)","relationship_id":"relationship--a33dbef1-994b-4dec-accb-6e63e9858f3e","references":[{"source_name":"Unit42 BendyBear Feb 2021","description":"Harbison, M. (2021, February 9). BendyBear: Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech. Retrieved February 16, 2021.","url":"https://unit42.paloaltonetworks.com/bendybear-shellcode-blacktech/"}]},{"id":"S0575","name":"Conti","url":"https://attack.mitre.org/software/S0575","kind":"malware","description":"[Conti](https://attack.mitre.org/software/S0575) has used API calls during execution.(Citation: Cybereason Conti Jan 2021)(Citation: CarbonBlack Conti July 2020) ","relationship_id":"relationship--f9a82ef5-524a-4b95-a9b5-560e61f3d2fa","references":[{"source_name":"Cybereason Conti Jan 2021","description":"Rochberger, L. (2021, January 12). Cybereason vs. Conti Ransomware. Retrieved February 17, 2021.","url":"https://www.cybereason.com/blog/cybereason-vs.-conti-ransomware"},{"source_name":"CarbonBlack Conti July 2020","description":"Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021.","url":"https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"}]},{"id":"S0576","name":"MegaCortex","url":"https://attack.mitre.org/software/S0576","kind":"malware","description":"After escalating privileges, [MegaCortex](https://attack.mitre.org/software/S0576) calls <code>TerminateProcess()</code>, <code>CreateRemoteThread</code>, and other Win32 APIs.(Citation: IBM MegaCortex)","relationship_id":"relationship--bf6a8896-2e07-4ed8-9f51-3847c3b0745f","references":[{"source_name":"IBM MegaCortex","description":"Del Fierro, C. Kessem, L.. (2020, January 8). From Mega to Giga: Cross-Version Comparison of Top MegaCortex Modifications. Retrieved February 15, 2021.","url":"https://securityintelligence.com/posts/from-mega-to-giga-cross-version-comparison-of-top-megacortex-modifications/"}]},{"id":"S0579","name":"Waterbear","url":"https://attack.mitre.org/software/S0579","kind":"malware","description":"[Waterbear](https://attack.mitre.org/software/S0579) can leverage API functions for execution.(Citation: Trend Micro Waterbear December 2019)","relationship_id":"relationship--dfcfd396-1c1f-42c0-ad12-da75d275ccc9","references":[{"source_name":"Trend Micro Waterbear December 2019","description":"Su, V. et al. (2019, December 11). Waterbear Returns, Uses API Hooking to Evade Security. Retrieved February 22, 2021.","url":"https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html"}]},{"id":"S0595","name":"ThiefQuest","url":"https://attack.mitre.org/software/S0595","kind":"malware","description":"[ThiefQuest](https://attack.mitre.org/software/S0595) uses various API to perform behaviors such as executing payloads and performing local enumeration.(Citation: wardle evilquest partii)","relationship_id":"relationship--dde881dc-6ad3-4819-b339-8019074818c7","references":[{"source_name":"wardle evilquest partii","description":"Patrick Wardle. (2020, July 3). OSX.EvilQuest Uncovered part ii: insidious capabilities. Retrieved March 21, 2021.","url":"https://objective-see.com/blog/blog_0x60.html"}]},{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) uses the SetSecurityDescriptorDacl API to reduce object integrity levels.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--d70530d5-b733-4b5a-9589-9f6a16670ed2","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S0606","name":"Bad Rabbit","url":"https://attack.mitre.org/software/S0606","kind":"malware","description":"[Bad Rabbit](https://attack.mitre.org/software/S0606) has used various Windows API calls.(Citation: ESET Bad Rabbit)","relationship_id":"relationship--b2852e21-c31a-482a-85fd-00d0990ee8ea","references":[{"source_name":"ESET Bad Rabbit","description":"M.Léveille, M-E.. (2017, October 24). Bad Rabbit: Not‑Petya is back with improved ransomware. Retrieved January 28, 2021.","url":"https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/"}]},{"id":"S0607","name":"KillDisk","url":"https://attack.mitre.org/software/S0607","kind":"malware","description":"[KillDisk](https://attack.mitre.org/software/S0607) has called the Windows API to retrieve the hard disk handle and shut down the machine.(Citation: Trend Micro KillDisk 1)","relationship_id":"relationship--1c69d2f9-1152-415a-9294-808886999e04","references":[{"source_name":"Trend Micro KillDisk 1","description":"Fernando Merces, Byron Gelera, Martin Co. (2018, June 7). KillDisk Variant Hits Latin American Finance Industry. Retrieved January 12, 2021.","url":"https://www.trendmicro.com/en_us/research/18/f/new-killdisk-variant-hits-latin-american-financial-organizations-again.html"}]},{"id":"S0610","name":"SideTwist","url":"https://attack.mitre.org/software/S0610","kind":"malware","description":"[SideTwist](https://attack.mitre.org/software/S0610) can use <code>GetUserNameW</code>, <code>GetComputerNameW</code>, and <code>GetComputerNameExW</code> to gather information.(Citation: Check Point APT34 April 2021)","relationship_id":"relationship--0b097893-c35a-4e75-ad26-d13ca0fd8b61","references":[{"source_name":"Check Point APT34 April 2021","description":"Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}]},{"id":"S0611","name":"Clop","url":"https://attack.mitre.org/software/S0611","kind":"malware","description":"[Clop](https://attack.mitre.org/software/S0611) has used built-in API functions such as WNetOpenEnumW(), WNetEnumResourceW(), WNetCloseEnum(), GetProcAddress(), and VirtualAlloc().(Citation: Mcafee Clop Aug 2019)(Citation: Cybereason Clop Dec 2020)","relationship_id":"relationship--16632684-1ef3-41bb-9ef1-97c6c3294448","references":[{"source_name":"Mcafee Clop Aug 2019","description":"Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/"},{"source_name":"Cybereason Clop Dec 2020","description":"Cybereason Nocturnus. (2020, December 23). Cybereason vs. Clop Ransomware. Retrieved May 11, 2021.","url":"https://www.cybereason.com/blog/cybereason-vs.-clop-ransomware"}]},{"id":"S0612","name":"WastedLocker","url":"https://attack.mitre.org/software/S0612","kind":"malware","description":"[WastedLocker](https://attack.mitre.org/software/S0612)'s custom crypter, CryptOne, leveraged the VirtualAlloc() API function to help execute the payload.(Citation: NCC Group WastedLocker June 2020)","relationship_id":"relationship--abbd6d5f-03a0-4e3c-b362-178879cfa016","references":[{"source_name":"NCC Group WastedLocker June 2020","description":"Antenucci, S., Pantazopoulos, N., Sandee, M. (2020, June 23). WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group. Retrieved September 14, 2021.","url":"https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/"}]},{"id":"S0614","name":"CostaBricks","url":"https://attack.mitre.org/software/S0614","kind":"malware","description":"[CostaBricks](https://attack.mitre.org/software/S0614) has used a number of API calls, including `VirtualAlloc`, `VirtualFree`, `LoadLibraryA`, `GetProcAddress`, and `ExitProcess`.(Citation: BlackBerry CostaRicto November 2020) ","relationship_id":"relationship--f10beefd-2bc1-4657-9c55-0ee28905b9ac","references":[{"source_name":"BlackBerry CostaRicto November 2020","description":"The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"}]},{"id":"S0615","name":"SombRAT","url":"https://attack.mitre.org/software/S0615","kind":"malware","description":"[SombRAT](https://attack.mitre.org/software/S0615) has the ability to respawn itself using <code>ShellExecuteW</code> and <code>CreateProcessW</code>.(Citation: BlackBerry CostaRicto November 2020)","relationship_id":"relationship--3fe56134-1a77-4df2-af85-9a68042c5fb8","references":[{"source_name":"BlackBerry CostaRicto November 2020","description":"The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"}]},{"id":"S0622","name":"AppleSeed","url":"https://attack.mitre.org/software/S0622","kind":"malware","description":"[AppleSeed](https://attack.mitre.org/software/S0622) has the ability to use multiple dynamically resolved API calls.(Citation: Malwarebytes Kimsuky June 2021)","relationship_id":"relationship--90ae4d92-9278-4cdd-a71c-b217a8bbb86a","references":[{"source_name":"Malwarebytes Kimsuky June 2021","description":"Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}]},{"id":"S0623","name":"Siloscape","url":"https://attack.mitre.org/software/S0623","kind":"malware","description":"[Siloscape](https://attack.mitre.org/software/S0623) makes various native API calls.(Citation: Unit 42 Siloscape Jun 2021)","relationship_id":"relationship--f8dbf944-f27b-4829-8781-9314908c9980","references":[{"source_name":"Unit 42 Siloscape Jun 2021","description":"Prizmant, D. (2021, June 7). Siloscape: First Known Malware Targeting Windows Containers to Compromise Cloud Environments. Retrieved June 9, 2021.","url":"https://unit42.paloaltonetworks.com/siloscape/"}]},{"id":"S0625","name":"Cuba","url":"https://attack.mitre.org/software/S0625","kind":"malware","description":"[Cuba](https://attack.mitre.org/software/S0625) has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum.(Citation: McAfee Cuba April 2021) ","relationship_id":"relationship--1326a801-6937-42ab-9916-e142ccc64261","references":[{"source_name":"McAfee Cuba April 2021","description":"Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf"}]},{"id":"S0627","name":"SodaMaster","url":"https://attack.mitre.org/software/S0627","kind":"malware","description":"[SodaMaster](https://attack.mitre.org/software/S0627) can use <code>RegOpenKeyW</code> to access the Registry.(Citation: Securelist APT10 March 2021)","relationship_id":"relationship--09254353-5452-4af7-8e7b-f297eff42a7f","references":[{"source_name":"Securelist APT10 March 2021","description":"GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021.","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}]},{"id":"S0629","name":"RainyDay","url":"https://attack.mitre.org/software/S0629","kind":"malware","description":"The file collection tool used by [RainyDay](https://attack.mitre.org/software/S0629) can utilize native API including <code>ReadDirectoryChangeW</code> for folder monitoring.(Citation: Bitdefender Naikon April 2021)","relationship_id":"relationship--09505cc8-8e0f-4283-9329-df2bea12867c","references":[{"source_name":"Bitdefender Naikon April 2021","description":"Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"id":"S0630","name":"Nebulae","url":"https://attack.mitre.org/software/S0630","kind":"malware","description":"[Nebulae](https://attack.mitre.org/software/S0630) has the ability to use <code>CreateProcess</code> to execute a process.(Citation: Bitdefender Naikon April 2021)","relationship_id":"relationship--777c4c38-9da2-4473-b5d0-61f175014760","references":[{"source_name":"Bitdefender Naikon April 2021","description":"Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"id":"S0631","name":"Chaes","url":"https://attack.mitre.org/software/S0631","kind":"malware","description":"[Chaes](https://attack.mitre.org/software/S0631) used the <code>CreateFileW()</code> API function with read permissions to access downloaded payloads.(Citation: Cybereason Chaes Nov 2020) ","relationship_id":"relationship--24a3fef1-9b1f-498b-8aca-df90565e6932","references":[{"source_name":"Cybereason Chaes Nov 2020","description":"Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021.","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"}]},{"id":"S0632","name":"GrimAgent","url":"https://attack.mitre.org/software/S0632","kind":"malware","description":"[GrimAgent](https://attack.mitre.org/software/S0632) can use Native API including <code>GetProcAddress</code> and <code>ShellExecuteW</code>.(Citation: Group IB GrimAgent July 2021)","relationship_id":"relationship--6abe4e38-5d96-469e-b648-dca7a520cc2e","references":[{"source_name":"Group IB GrimAgent July 2021","description":"Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.","url":"https://www.group-ib.com/blog/grimagent/"}]},{"id":"S0638","name":"Babuk","url":"https://attack.mitre.org/software/S0638","kind":"malware","description":"[Babuk](https://attack.mitre.org/software/S0638) can use multiple Windows API calls for actions on compromised hosts including discovery and execution.(Citation: Sogeti CERT ESEC Babuk March 2021)(Citation: McAfee Babuk February 2021)(Citation: Medium Babuk February 2021)","relationship_id":"relationship--1095b9e8-2849-40c2-b56f-f6bc9d4bc648","references":[{"source_name":"Sogeti CERT ESEC Babuk March 2021","description":"Sogeti. (2021, March). Babuk Ransomware. Retrieved August 11, 2021.","url":"https://www.sogeti.com/globalassets/reports/cybersecchronicles_-_babuk.pdf"},{"source_name":"McAfee Babuk February 2021","description":"Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-ransomware.pdf"},{"source_name":"Medium Babuk February 2021","description":"Sebdraven. (2021, February 8). Babuk is distributed packed. Retrieved August 11, 2021.","url":"https://sebdraven.medium.com/babuk-is-distributed-packed-78e2f5dd2e62"}]},{"id":"S0640","name":"Avaddon","url":"https://attack.mitre.org/software/S0640","kind":"malware","description":"[Avaddon](https://attack.mitre.org/software/S0640) has used the Windows Crypto API to generate an AES key.(Citation: Hornet Security Avaddon June 2020)","relationship_id":"relationship--53948a0d-1c53-4569-b6b3-78b7738793c3","references":[{"source_name":"Hornet Security Avaddon June 2020","description":"Security Lab. (2020, June 5). Avaddon: From seeking affiliates to in-the-wild in 2 days. Retrieved August 19, 2021.","url":"https://www.hornetsecurity.com/en/security-information/avaddon-from-seeking-affiliates-to-in-the-wild-in-2-days/"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"[QakBot](https://attack.mitre.org/software/S0650) can use <code>GetProcAddress</code> to help delete malicious strings from memory.(Citation: ATT QakBot April 2021)","relationship_id":"relationship--14a8d0df-a875-45ed-be76-c671c1771179","references":[{"source_name":"ATT QakBot April 2021","description":"Morrow, D. (2021, April 15). The rise of QakBot. Retrieved September 27, 2021.","url":"https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"}]},{"id":"S0651","name":"BoxCaon","url":"https://attack.mitre.org/software/S0651","kind":"malware","description":"[BoxCaon](https://attack.mitre.org/software/S0651) has used Windows API calls to obtain information about the compromised host.(Citation: Checkpoint IndigoZebra July 2021)","relationship_id":"relationship--3436ac2b-eadf-4aec-bd3a-cb814fd057b8","references":[{"source_name":"Checkpoint IndigoZebra July 2021","description":"CheckPoint Research. (2021, July 1). IndigoZebra APT continues to attack Central Asia with evolving tools. Retrieved September 24, 2021.","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"}]},{"id":"S0652","name":"MarkiRAT","url":"https://attack.mitre.org/software/S0652","kind":"malware","description":"[MarkiRAT](https://attack.mitre.org/software/S0652) can run the ShellExecuteW API via the Windows Command Shell.(Citation: Kaspersky Ferocious Kitten Jun 2021)","relationship_id":"relationship--2d353aa1-9975-43cf-9aa3-3ef02fd3e61a","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","description":"GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}]},{"id":"S0653","name":"xCaon","url":"https://attack.mitre.org/software/S0653","kind":"malware","description":"[xCaon](https://attack.mitre.org/software/S0653) has leveraged native OS function calls to retrieve  victim's network adapter's  information using GetAdapterInfo() API.(Citation: Checkpoint IndigoZebra July 2021) ","relationship_id":"relationship--c9342b34-f936-4913-aaee-71fcc5347fd4","references":[{"source_name":"Checkpoint IndigoZebra July 2021","description":"CheckPoint Research. (2021, July 1). IndigoZebra APT continues to attack Central Asia with evolving tools. Retrieved September 24, 2021.","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"}]},{"id":"S0659","name":"Diavol","url":"https://attack.mitre.org/software/S0659","kind":"malware","description":"[Diavol](https://attack.mitre.org/software/S0659) has used several API calls like `GetLogicalDriveStrings`, `SleepEx`, `SystemParametersInfoAPI`, `CryptEncrypt`, and others to execute parts of its attack.(Citation: Fortinet Diavol July 2021)","relationship_id":"relationship--b4ff0d25-3efb-4deb-898e-f25e18d4ae90","references":[{"source_name":"Fortinet Diavol July 2021","description":"Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.","url":"https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"}]},{"id":"S0661","name":"FoggyWeb","url":"https://attack.mitre.org/software/S0661","kind":"malware","description":"[FoggyWeb](https://attack.mitre.org/software/S0661)'s loader can use API functions to load the [FoggyWeb](https://attack.mitre.org/software/S0661) backdoor into the same Application Domain within which the legitimate AD FS managed code is executed.(Citation: MSTIC FoggyWeb September 2021)","relationship_id":"relationship--85425f5c-a65e-43fe-8c69-594425b6608f","references":[{"source_name":"MSTIC FoggyWeb September 2021","description":"Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"}]},{"id":"S0662","name":"RCSession","url":"https://attack.mitre.org/software/S0662","kind":"malware","description":"[RCSession](https://attack.mitre.org/software/S0662) can use WinSock API for communication including <code>WSASend</code> and <code>WSARecv</code>.(Citation: Profero APT27 December 2020)","relationship_id":"relationship--7908bc8d-8a9b-48c0-897e-25266950b0da","references":[{"source_name":"Profero APT27 December 2020","description":"Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"}]},{"id":"S0663","name":"SysUpdate","url":"https://attack.mitre.org/software/S0663","kind":"malware","description":"[SysUpdate](https://attack.mitre.org/software/S0663) can call the `GetNetworkParams` API as part of its C2 establishment process.(Citation: Lunghi Iron Tiger Linux)","relationship_id":"relationship--e28c174a-33d6-4fef-989f-7c58d0fb770d","references":[{"source_name":"Lunghi Iron Tiger Linux","description":"Daniel Lunghi. (2023, March 1). Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting. Retrieved March 20, 2023.","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"}]},{"id":"S0666","name":"Gelsemium","url":"https://attack.mitre.org/software/S0666","kind":"malware","description":"[Gelsemium](https://attack.mitre.org/software/S0666) has the ability to use various Windows API functions to perform tasks.(Citation: ESET Gelsemium June 2021)","relationship_id":"relationship--cca0dc19-ea37-4502-b2d4-7ce09f07be72","references":[{"source_name":"ESET Gelsemium June 2021","description":"Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}]},{"id":"S0667","name":"Chrommme","url":"https://attack.mitre.org/software/S0667","kind":"malware","description":"[Chrommme](https://attack.mitre.org/software/S0667) can use Windows API including `WinExec` for execution.(Citation: ESET Gelsemium June 2021)","relationship_id":"relationship--a483131c-b3b5-4682-aafc-2761d75e2168","references":[{"source_name":"ESET Gelsemium June 2021","description":"Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}]},{"id":"S0668","name":"TinyTurla","url":"https://attack.mitre.org/software/S0668","kind":"malware","description":"[TinyTurla](https://attack.mitre.org/software/S0668) has used `WinHTTP`, `CreateProcess`, and other APIs for C2 communications and other functions.(Citation: Talos TinyTurla September 2021)","relationship_id":"relationship--1a471326-20d2-41e2-8dc5-dd9d9ce5a7e1","references":[{"source_name":"Talos TinyTurla September 2021","description":"Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021.","url":"https://blog.talosintelligence.com/2021/09/tinyturla.html"}]},{"id":"S0669","name":"KOCTOPUS","url":"https://attack.mitre.org/software/S0669","kind":"malware","description":"[KOCTOPUS](https://attack.mitre.org/software/S0669) can use the `LoadResource` and `CreateProcessW` APIs for execution.(Citation: MalwareBytes LazyScripter Feb 2021)","relationship_id":"relationship--be75f0ef-a8c8-42ec-b36b-670f7b528dd3","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","description":"Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"id":"S0670","name":"WarzoneRAT","url":"https://attack.mitre.org/software/S0670","kind":"malware","description":"[WarzoneRAT](https://attack.mitre.org/software/S0670) can use a variety of API calls on a compromised host.(Citation: Uptycs Warzone UAC Bypass November 2020)","relationship_id":"relationship--9e9daac0-86ce-493f-a1b4-6c4e9d0e39ff","references":[{"source_name":"Uptycs Warzone UAC Bypass November 2020","description":"Mohanta, A. (2020, November 25). Warzone RAT comes with UAC bypass technique. Retrieved April 7, 2022.","url":"https://www.uptycs.com/blog/warzone-rat-comes-with-uac-bypass-technique"}]},{"id":"S0678","name":"Torisma","url":"https://attack.mitre.org/software/S0678","kind":"malware","description":"[Torisma](https://attack.mitre.org/software/S0678) has used various Windows API calls.(Citation: McAfee Lazarus Nov 2020)","relationship_id":"relationship--0872f093-cfab-4e63-bfde-b7748808c96f","references":[{"source_name":"McAfee Lazarus Nov 2020","description":"Beek, C. (2020, November 5). Operation North Star: Behind The Scenes. Retrieved December 20, 2021.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-behind-the-scenes/"}]},{"id":"S0680","name":"LitePower","url":"https://attack.mitre.org/software/S0680","kind":"malware","description":"[LitePower](https://attack.mitre.org/software/S0680) can use various API calls.(Citation: Kaspersky WIRTE November 2021)","relationship_id":"relationship--85965bfa-658a-47e5-b15d-c0ef67341bda","references":[{"source_name":"Kaspersky WIRTE November 2021","description":"Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}]},{"id":"S0681","name":"Lizar","url":"https://attack.mitre.org/software/S0681","kind":"malware","description":"[Lizar](https://attack.mitre.org/software/S0681) has used various Windows API functions on a victim's machine.(Citation: BiZone Lizar May 2021) ","relationship_id":"relationship--44927ff0-b153-4122-a881-ff078a3e81cd","references":[{"source_name":"BiZone Lizar May 2021","description":"BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022.","url":"https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"}]},{"id":"S0687","name":"Cyclops Blink","url":"https://attack.mitre.org/software/S0687","kind":"malware","description":"[Cyclops Blink](https://attack.mitre.org/software/S0687) can use various Linux API functions including those for execution and discovery.(Citation: NCSC Cyclops Blink February 2022)","relationship_id":"relationship--0229d70b-03ef-4744-aa06-348dd4bcbd10","references":[{"source_name":"NCSC Cyclops Blink February 2022","description":"NCSC. (2022, February 23). Cyclops Blink Malware Analysis Report. Retrieved March 3, 2022.","url":"https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf"}]},{"id":"S0688","name":"Meteor","url":"https://attack.mitre.org/software/S0688","kind":"malware","description":"[Meteor](https://attack.mitre.org/software/S0688) can use `WinAPI` to remove a victim machine from an Active Directory domain.(Citation: Check Point Meteor Aug 2021)","relationship_id":"relationship--717cce1c-bbb9-4735-80d0-3d13ea56f248","references":[{"source_name":"Check Point Meteor Aug 2021","description":"Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022.","url":"https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"}]},{"id":"S0689","name":"WhisperGate","url":"https://attack.mitre.org/software/S0689","kind":"malware","description":"[WhisperGate](https://attack.mitre.org/software/S0689) has used the `ExitWindowsEx` to flush file buffers to disk and stop running processes and other API calls.(Citation: Cisco Ukraine Wipers January 2022)(Citation: RecordedFuture WhisperGate Jan 2022)","relationship_id":"relationship--5580b0f6-7679-46c3-adb5-270c87f8ef69","references":[{"source_name":"Cisco Ukraine Wipers January 2022","description":"Biasini, N. et al.. (2022, January 21). Ukraine Campaign Delivers Defacement and Wipers, in Continued Escalation. Retrieved March 14, 2022.","url":"https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html"},{"source_name":"RecordedFuture WhisperGate Jan 2022","description":"Insikt Group. (2020, January 28). WhisperGate Malware Corrupts Computers in Ukraine. Retrieved September 16, 2024.","url":"https://www.recordedfuture.com/research/whispergate-malware-corrupts-computers-ukraine"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) has the ability to leverage API including `GetProcAddress` and `LoadLibrary`.(Citation: GitHub SILENTTRINITY Modules July 2019)","relationship_id":"relationship--9002b775-c016-404f-b9b3-16fcbcd0949c","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","description":"Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}]},{"id":"S0693","name":"CaddyWiper","url":"https://attack.mitre.org/software/S0693","kind":"malware","description":"[CaddyWiper](https://attack.mitre.org/software/S0693) has the ability to dynamically resolve and use APIs, including `SeTakeOwnershipPrivilege`.(Citation: Cisco CaddyWiper March 2022)","relationship_id":"relationship--eab5970e-e491-44e6-90a2-203d9a7b4042","references":[{"source_name":"Cisco CaddyWiper March 2022","description":"Malhotra, A. (2022, March 15). Threat Advisory: CaddyWiper. Retrieved March 23, 2022.","url":"https://blog.talosintelligence.com/2022/03/threat-advisory-caddywiper.html"}]},{"id":"S0694","name":"DRATzarus","url":"https://attack.mitre.org/software/S0694","kind":"malware","description":"[DRATzarus](https://attack.mitre.org/software/S0694) can use various API calls to see if it is running in a sandbox.(Citation: ClearSky Lazarus Aug 2020)","relationship_id":"relationship--961e9aba-801c-45a4-b1a9-0717761a0f62","references":[{"source_name":"ClearSky Lazarus Aug 2020","description":"ClearSky Research Team. (2020, August 13). Operation 'Dream Job' Widespread North Korean Espionage Campaign. Retrieved December 20, 2021.","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/Dream-Job-Campaign.pdf"}]},{"id":"S0695","name":"Donut","url":"https://attack.mitre.org/software/S0695","kind":"tool","description":"[Donut](https://attack.mitre.org/software/S0695) code modules use various API functions to load and inject code.(Citation: Donut Github)\t","relationship_id":"relationship--a107acee-85a7-475c-bb99-c12a379ef2dc","references":[{"source_name":"Donut Github","description":"TheWover. (2019, May 9). donut. Retrieved March 25, 2022.","url":"https://github.com/TheWover/donut"}]},{"id":"S0696","name":"Flagpro","url":"https://attack.mitre.org/software/S0696","kind":"malware","description":"[Flagpro](https://attack.mitre.org/software/S0696) can use Native API to enable obfuscation including `GetLastError` and `GetTickCount`.(Citation: NTT Security Flagpro new December 2021)","relationship_id":"relationship--d0722ad7-32c5-4249-90b2-e76bea63ea59","references":[{"source_name":"NTT Security Flagpro new December 2021","description":"Hada, H. (2021, December 28).  Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.","url":"https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"}]},{"id":"S0697","name":"HermeticWiper","url":"https://attack.mitre.org/software/S0697","kind":"malware","description":"[HermeticWiper](https://attack.mitre.org/software/S0697) can call multiple Windows API functions used for privilege escalation, service execution, and to overwrite random bites of data.(Citation: SentinelOne Hermetic Wiper February 2022)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: ESET Hermetic Wizard March 2022)(Citation: Qualys Hermetic Wiper March 2022)","relationship_id":"relationship--916e5e5c-7856-47e7-9749-58621671d158","references":[{"source_name":"Qualys Hermetic Wiper March 2022","description":"Dani, M. (2022, March 1). Ukrainian Targets Hit by HermeticWiper, New Datawiper Malware. Retrieved March 25, 2022.","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware"},{"source_name":"ESET Hermetic Wizard March 2022","description":"ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022.","url":"https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine"},{"source_name":"SentinelOne Hermetic Wiper February 2022","description":"Guerrero-Saade, J. (2022, February 23). HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine. Retrieved March 25, 2022.","url":"https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack"},{"source_name":"Crowdstrike DriveSlayer February 2022","description":"Thomas, W. et al. (2022, February 25). CrowdStrike Falcon Protects from New Wiper Malware Used in Ukraine Cyberattacks. Retrieved March 25, 2022.","url":"https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/"}]},{"id":"S0698","name":"HermeticWizard","url":"https://attack.mitre.org/software/S0698","kind":"malware","description":"[HermeticWizard](https://attack.mitre.org/software/S0698) can connect to remote shares using `WNetAddConnection2W`.(Citation: ESET Hermetic Wizard March 2022)","relationship_id":"relationship--8ff9263a-c32c-4fcf-b20b-9da4647baf99","references":[{"source_name":"ESET Hermetic Wizard March 2022","description":"ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022.","url":"https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine"}]},{"id":"S1013","name":"ZxxZ","url":"https://attack.mitre.org/software/S1013","kind":"malware","description":"[ZxxZ](https://attack.mitre.org/software/S1013) has used API functions such as `Process32First`, `Process32Next`, and `ShellExecuteA`.(Citation: Cisco Talos Bitter Bangladesh May 2022)","relationship_id":"relationship--0a3c7f91-6020-46f8-be45-d0a8cf86956e","references":[{"source_name":"Cisco Talos Bitter Bangladesh May 2022","description":"Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022.","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}]},{"id":"S1015","name":"Milan","url":"https://attack.mitre.org/software/S1015","kind":"malware","description":"[Milan](https://attack.mitre.org/software/S1015) can use the API `DnsQuery_A` for DNS resolution.(Citation: Kaspersky Lyceum October 2021)","relationship_id":"relationship--9b2f9a03-f477-4d1f-8542-27243fa6a3ab","references":[{"source_name":"Kaspersky Lyceum October 2021","description":"Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"id":"S1016","name":"MacMa","url":"https://attack.mitre.org/software/S1016","kind":"malware","description":"[MacMa](https://attack.mitre.org/software/S1016) has used macOS API functions to perform tasks.(Citation: ESET DazzleSpy Jan 2022)(Citation: Objective-See MacMa Nov 2021)","relationship_id":"relationship--78019dcb-e8d3-4c71-bad0-20f3e85968b2","references":[{"source_name":"ESET DazzleSpy Jan 2022","description":"M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"},{"source_name":"Objective-See MacMa Nov 2021","description":"Wardle, P. (2021, November 11). OSX.CDDS (OSX.MacMa). Retrieved June 30, 2022.","url":"https://objective-see.org/blog/blog_0x69.html"}]},{"id":"S1018","name":"Saint Bot","url":"https://attack.mitre.org/software/S1018","kind":"malware","description":"[Saint Bot](https://attack.mitre.org/software/S1018) has used different API calls, including `GetProcAddress`, `VirtualAllocEx`, `WriteProcessMemory`, `CreateProcessA`, and `SetThreadContext`.(Citation: Malwarebytes Saint Bot April 2021)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )","relationship_id":"relationship--6052eaae-d1a4-47aa-91ff-e1db16521dd3","references":[{"source_name":"Malwarebytes Saint Bot April 2021","description":"Hasherezade. (2021, April 6). A deep dive into Saint Bot, a new downloader. Retrieved June 9, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"},{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","description":"Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"id":"S1020","name":"Kevin","url":"https://attack.mitre.org/software/S1020","kind":"malware","description":"[Kevin](https://attack.mitre.org/software/S1020) can use the `ShowWindow` API to avoid detection.(Citation: Kaspersky Lyceum October 2021)","relationship_id":"relationship--95ca9378-9ec1-43cb-9ffb-5f7c79cf7898","references":[{"source_name":"Kaspersky Lyceum October 2021","description":"Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"id":"S1025","name":"Amadey","url":"https://attack.mitre.org/software/S1025","kind":"malware","description":"[Amadey](https://attack.mitre.org/software/S1025) has used a variety of Windows API calls, including `GetComputerNameA`, `GetUserNameA`, and `CreateProcessA`.(Citation: BlackBerry Amadey 2020)","relationship_id":"relationship--26818c78-7042-4493-a94b-eec0d7b9972a","references":[{"source_name":"BlackBerry Amadey 2020","description":"Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.","url":"https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot"}]},{"id":"S1033","name":"DCSrv","url":"https://attack.mitre.org/software/S1033","kind":"malware","description":"[DCSrv](https://attack.mitre.org/software/S1033) has used various Windows API functions, including `DeviceIoControl`, as part of its encryption process.(Citation: Checkpoint MosesStaff Nov 2021)","relationship_id":"relationship--6b580198-d882-4875-b1d5-ad937b95f12f","references":[{"source_name":"Checkpoint MosesStaff Nov 2021","description":"Checkpoint Research. (2021, November 15). Uncovering MosesStaff techniques: Ideology over Money. Retrieved August 11, 2022.","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"id":"S1034","name":"StrifeWater","url":"https://attack.mitre.org/software/S1034","kind":"malware","description":"[StrifeWater](https://attack.mitre.org/software/S1034) can use a variety of APIs for execution.(Citation: Cybereason StrifeWater Feb 2022)","relationship_id":"relationship--222fdbe3-5833-4be9-aa45-b85087606dc1","references":[{"source_name":"Cybereason StrifeWater Feb 2022","description":"Cybereason Nocturnus. (2022, February 1). StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations. Retrieved August 15, 2022.","url":"https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"}]},{"id":"S1039","name":"Bumblebee","url":"https://attack.mitre.org/software/S1039","kind":"malware","description":"[Bumblebee](https://attack.mitre.org/software/S1039) can use multiple Native APIs.(Citation: Proofpoint Bumblebee April 2022)(Citation: Medium Ali Salem Bumblebee April 2022)","relationship_id":"relationship--8ba708a9-07a3-4c4e-8fee-15a1cdabf2f7","references":[{"source_name":"Proofpoint Bumblebee April 2022","description":"Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.","url":"https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"},{"source_name":"Medium Ali Salem Bumblebee April 2022","description":"Salem, A. (2022, April 27). The chronicles of Bumblebee: The Hook, the Bee, and the Trickbot connection. Retrieved September 2, 2022.","url":"https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056"}]},{"id":"S1044","name":"FunnyDream","url":"https://attack.mitre.org/software/S1044","kind":"malware","description":"[FunnyDream](https://attack.mitre.org/software/S1044) can use Native API for defense evasion, discovery, and collection.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--bc70728d-9f56-43df-8580-1d22c829bd14","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1050","name":"PcShare","url":"https://attack.mitre.org/software/S1050","kind":"tool","description":"[PcShare](https://attack.mitre.org/software/S1050) has used a variety of Windows API functions.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--dbfabc52-92a7-4814-aec8-27f2afe816e5","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1052","name":"DEADEYE","url":"https://attack.mitre.org/software/S1052","kind":"malware","description":"[DEADEYE](https://attack.mitre.org/software/S1052) can execute the `GetComputerNameA` and `GetComputerNameExA` WinAPI functions.(Citation: Mandiant APT41)","relationship_id":"relationship--64b7eeef-4ccb-4b92-8224-63f1d61265a5","references":[{"source_name":"Mandiant APT41","description":"Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}]},{"id":"S1053","name":"AvosLocker","url":"https://attack.mitre.org/software/S1053","kind":"malware","description":"[AvosLocker](https://attack.mitre.org/software/S1053) has used a variety of Windows API calls, including `NtCurrentPeb` and `GetLogicalDrives`.(Citation: Malwarebytes AvosLocker Jul 2021)","relationship_id":"relationship--1b0ca110-bb1d-434d-a271-6574fdb11723","references":[{"source_name":"Malwarebytes AvosLocker Jul 2021","description":"Hasherezade. (2021, July 23). AvosLocker enters the ransomware scene, asks for partners. Retrieved January 11, 2023.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners"}]},{"id":"S1058","name":"Prestige","url":"https://attack.mitre.org/software/S1058","kind":"malware","description":"[Prestige](https://attack.mitre.org/software/S1058) has used the `Wow64DisableWow64FsRedirection()` and `Wow64RevertWow64FsRedirection()` functions to disable and restore file system redirection.(Citation: Microsoft Prestige ransomware October 2022) ","relationship_id":"relationship--9654ee15-fdca-4d74-98b8-11a81a19d892","references":[{"source_name":"Microsoft Prestige ransomware October 2022","description":"MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"id":"S1059","name":"metaMain","url":"https://attack.mitre.org/software/S1059","kind":"malware","description":"[metaMain](https://attack.mitre.org/software/S1059) can execute an operator-provided Windows command by leveraging functions such as `WinExec`, `WriteFile`, and `ReadFile`.(Citation: SentinelLabs Metador Sept 2022)(Citation: SentinelLabs Metador Technical Appendix Sept 2022)","relationship_id":"relationship--73675ce7-d059-424a-9f8f-683188b19017","references":[{"source_name":"SentinelLabs Metador Sept 2022","description":"Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"},{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","description":"SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}]},{"id":"S1060","name":"Mafalda","url":"https://attack.mitre.org/software/S1060","kind":"malware","description":"[Mafalda](https://attack.mitre.org/software/S1060) can use a variety of API calls.(Citation: SentinelLabs Metador Sept 2022)","relationship_id":"relationship--cb0632ef-fb36-44c1-916c-4de7ce1c956e","references":[{"source_name":"SentinelLabs Metador Sept 2022","description":"Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]},{"id":"S1063","name":"Brute Ratel C4","url":"https://attack.mitre.org/software/S1063","kind":"tool","description":"[Brute Ratel C4](https://attack.mitre.org/software/S1063) can call multiple Windows APIs for execution, to share memory, and defense evasion.(Citation: Palo Alto Brute Ratel July 2022)(Citation: MDSec Brute Ratel August 2022)","relationship_id":"relationship--b323db77-6bbf-4020-ac48-bee625dd44f2","references":[{"source_name":"MDSec Brute Ratel August 2022","description":"Chell, D.  PART 3: How I Met Your Beacon – Brute Ratel. Retrieved February 6, 2023.","url":"https://www.mdsec.co.uk/2022/08/part-3-how-i-met-your-beacon-brute-ratel/"},{"source_name":"Palo Alto Brute Ratel July 2022","description":"Harbison, M. and Renals, P. (2022, July 5). When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors. Retrieved February 1, 2023.","url":"https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/"}]},{"id":"S1064","name":"SVCReady","url":"https://attack.mitre.org/software/S1064","kind":"malware","description":"[SVCReady](https://attack.mitre.org/software/S1064) can use Windows API calls to gather information from an infected host.(Citation: HP SVCReady Jun 2022)","relationship_id":"relationship--990d1dde-8b25-4b83-93a0-50533b557b82","references":[{"source_name":"HP SVCReady Jun 2022","description":"Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.","url":"https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"}]},{"id":"S1065","name":"Woody RAT","url":"https://attack.mitre.org/software/S1065","kind":"malware","description":"[Woody RAT](https://attack.mitre.org/software/S1065) can use multiple native APIs, including `WriteProcessMemory`, `CreateProcess`, and `CreateRemoteThread` for process injection.(Citation: MalwareBytes WoodyRAT Aug 2022)  ","relationship_id":"relationship--b2191a9b-4963-4fc1-8056-75908795a1af","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","description":"MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}]},{"id":"S1066","name":"DarkTortilla","url":"https://attack.mitre.org/software/S1066","kind":"malware","description":"[DarkTortilla](https://attack.mitre.org/software/S1066) can use a variety of API calls for persistence and defense evasion.(Citation: Secureworks DarkTortilla Aug 2022)","relationship_id":"relationship--b00ac705-cb96-4c05-9e90-b2663387d80c","references":[{"source_name":"Secureworks DarkTortilla Aug 2022","description":"Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022.","url":"https://www.secureworks.com/research/darktortilla-malware-analysis"}]},{"id":"S1070","name":"Black Basta","url":"https://attack.mitre.org/software/S1070","kind":"malware","description":"[Black Basta](https://attack.mitre.org/software/S1070) has the ability to use native APIs for numerous functions including discovery and defense evasion.(Citation: Minerva Labs Black Basta May 2022)(Citation: Cyble Black Basta May 2022)(Citation: Avertium Black Basta June 2022)(Citation: Check Point Black Basta October 2022)(Citation: Trend Micro Black Basta May 2022) ","relationship_id":"relationship--d10cea20-846f-4c55-9566-cd7367ae6488","references":[{"source_name":"Avertium Black Basta June 2022","description":"Avertium. (2022, June 1). AN IN-DEPTH LOOK AT BLACK BASTA RANSOMWARE. Retrieved March 7, 2023.","url":"https://www.avertium.com/resources/threat-reports/in-depth-look-at-black-basta-ransomware"},{"source_name":"Check Point Black Basta October 2022","description":"Check Point. (2022, October 20). BLACK BASTA AND THE UNNOTICED DELIVERY. Retrieved March 8, 2023.","url":"https://research.checkpoint.com/2022/black-basta-and-the-unnoticed-delivery/"},{"source_name":"Cyble Black Basta May 2022","description":"Cyble. (2022, May 6). New ransomware variant targeting high-value organizations. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20220506143054/https://blog.cyble.com/2022/05/06/black-basta-ransomware/"},{"source_name":"Trend Micro Black Basta May 2022","description":"Gonzalez, I., Chavez I., et al. (2022, May 9). Examining the Black Basta Ransomware’s Infection Routine. Retrieved March 7, 2023.","url":"https://www.trendmicro.com/en_us/research/22/e/examining-the-black-basta-ransomwares-infection-routine.html"},{"source_name":"Minerva Labs Black Basta May 2022","description":"Zargarov, N. (2022, May 2). New Black Basta Ransomware Hijacks Windows Fax Service. Retrieved March 7, 2023.","url":"https://minerva-labs.com/blog/new-black-basta-ransomware-hijacks-windows-fax-service/"}]},{"id":"S1073","name":"Royal","url":"https://attack.mitre.org/software/S1073","kind":"malware","description":"[Royal](https://attack.mitre.org/software/S1073) can use multiple APIs for discovery, communication, and execution.(Citation: Cybereason Royal December 2022)","relationship_id":"relationship--d0144271-c8e4-4cb3-b977-17b750c7193d","references":[{"source_name":"Cybereason Royal December 2022","description":"Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023.","url":"https://www.cybereason.com/blog/royal-ransomware-analysis"}]},{"id":"S1076","name":"QUIETCANARY","url":"https://attack.mitre.org/software/S1076","kind":"malware","description":"[QUIETCANARY](https://attack.mitre.org/software/S1076) can call `System.Net.HttpWebRequest` to identify the default proxy configured on the victim computer.(Citation: Mandiant Suspected Turla Campaign February 2023)","relationship_id":"relationship--c07cd7e2-1744-412c-ac58-4ec448a51f01","references":[{"source_name":"Mandiant Suspected Turla Campaign February 2023","description":"Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.","url":"https://www.mandiant.com/resources/blog/turla-galaxy-opportunity"}]},{"id":"S1078","name":"RotaJakiro","url":"https://attack.mitre.org/software/S1078","kind":"malware","description":"When executing with non-root permissions, [RotaJakiro](https://attack.mitre.org/software/S1078) uses the the `shmget` API to create shared memory between other known [RotaJakiro](https://attack.mitre.org/software/S1078) processes. [RotaJakiro](https://attack.mitre.org/software/S1078) also uses the `execvp` API to help its dead process \"resurrect\".(Citation: RotaJakiro 2021 netlab360 analysis)","relationship_id":"relationship--3fa24e29-2791-4b10-8014-bfa817c3a2f2","references":[{"source_name":"RotaJakiro 2021 netlab360 analysis","description":" Alex Turing, Hui Wang. (2021, April 28). RotaJakiro: A long live secret backdoor with 0 VT detection. Retrieved June 14, 2023.","url":"https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/"}]},{"id":"S1081","name":"BADHATCH","url":"https://attack.mitre.org/software/S1081","kind":"malware","description":"[BADHATCH](https://attack.mitre.org/software/S1081) can utilize Native API functions such as, `ToolHelp32` and `Rt1AdjustPrivilege` to enable `SeDebugPrivilege` on a compromised machine.(Citation: Gigamon BADHATCH Jul 2019)","relationship_id":"relationship--6d49721f-17a2-4f02-a760-f0bfe9c0b759","references":[{"source_name":"Gigamon BADHATCH Jul 2019","description":"Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.","url":"https://blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling/"}]},{"id":"S1085","name":"Sardonic","url":"https://attack.mitre.org/software/S1085","kind":"malware","description":"[Sardonic](https://attack.mitre.org/software/S1085) has the ability to call Win32 API functions to determine if `powershell.exe` is running.(Citation: Bitdefender Sardonic Aug 2021) ","relationship_id":"relationship--af0f063e-811e-40fd-8ea4-135bf10f95b7","references":[{"source_name":"Bitdefender Sardonic Aug 2021","description":"Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"}]},{"id":"S1087","name":"AsyncRAT","url":"https://attack.mitre.org/software/S1087","kind":"tool","description":"[AsyncRAT](https://attack.mitre.org/software/S1087) has the ability to use OS APIs including `CheckRemoteDebuggerPresent`.(Citation: Telefonica Snip3 December 2021)","relationship_id":"relationship--10435dca-baee-420a-a2b3-b13209e2d96a","references":[{"source_name":"Telefonica Snip3 December 2021","description":"Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.","url":"https://telefonicatech.com/blog/snip3-investigacion-malware"}]},{"id":"S1089","name":"SharpDisco","url":"https://attack.mitre.org/software/S1089","kind":"malware","description":"[SharpDisco](https://attack.mitre.org/software/S1089) can leverage Native APIs through plugins including `GetLogicalDrives`.(Citation: MoustachedBouncer ESET August 2023)","relationship_id":"relationship--e6aad2f6-4fb8-4987-a316-e7d50269a254","references":[{"source_name":"MoustachedBouncer ESET August 2023","description":"Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"id":"S1090","name":"NightClub","url":"https://attack.mitre.org/software/S1090","kind":"malware","description":"[NightClub](https://attack.mitre.org/software/S1090) can use multiple native APIs including `GetKeyState`, `GetForegroundWindow`, `GetWindowThreadProcessId`, and `GetKeyboardLayout`.(Citation: MoustachedBouncer ESET August 2023)","relationship_id":"relationship--2b3cf66b-29d9-4251-b170-977def2692ad","references":[{"source_name":"MoustachedBouncer ESET August 2023","description":"Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"id":"S1099","name":"Samurai","url":"https://attack.mitre.org/software/S1099","kind":"malware","description":"[Samurai](https://attack.mitre.org/software/S1099) has the ability to call Windows APIs.(Citation: Kaspersky ToddyCat June 2022)","relationship_id":"relationship--fcacc3e1-f343-4013-97cf-ce5d5f700c13","references":[{"source_name":"Kaspersky ToddyCat June 2022","description":"Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat/106799/"}]},{"id":"S1100","name":"Ninja","url":"https://attack.mitre.org/software/S1100","kind":"malware","description":"The [Ninja](https://attack.mitre.org/software/S1100) loader can call Windows APIs for discovery, process injection, and payload decryption.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)","relationship_id":"relationship--5f667e29-dd41-4dd4-a74d-fff899fe4ac6","references":[{"source_name":"Kaspersky ToddyCat June 2022","description":"Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat/106799/"},{"source_name":"Kaspersky ToddyCat Check Logs October 2023","description":"Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) uses the native Windows API <code>CallWindowProc()</code> to decode and launch encoded shellcode payloads during execution.(Citation: Trellix Darkgate 2023) [DarkGate](https://attack.mitre.org/software/S1111) can call kernel mode functions directly to hide the use of process hollowing methods during execution.(Citation: Ensilo Darkgate 2018) [DarkGate](https://attack.mitre.org/software/S1111) has also used the `CreateToolhelp32Snapshot`, `GetFileAttributesA` and `CreateProcessA` functions to obtain a list of running processes, to check for security products and to execute its malware.(Citation: Rapid7 BlackBasta 2024) ","relationship_id":"relationship--a5252967-35e1-426a-8e92-ee066b7abcfc","references":[{"source_name":"Ensilo Darkgate 2018","description":"Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"},{"source_name":"Trellix Darkgate 2023","description":"Ernesto Fernández Provecho, Pham Duy Phuc, Ciana Driscoll & Vinoo Thomas. (2023, November 21). The Continued Evolution of the DarkGate Malware-as-a-Service. Retrieved February 9, 2024.","url":"https://www.trellix.com/blogs/research/the-continued-evolution-of-the-darkgate-malware-as-a-service/"},{"source_name":"Rapid7 BlackBasta 2024","description":"McGraw, T. (2024, December 4). Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware. Retrieved December 9, 2024.","url":"https://www.rapid7.com/blog/post/2024/12/04/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware/"}]},{"id":"S1122","name":"Mispadu","url":"https://attack.mitre.org/software/S1122","kind":"malware","description":"[Mispadu](https://attack.mitre.org/software/S1122) has used a variety of Windows API calls, including ShellExecute and WriteProcessMemory.(Citation: Segurança Informática URSA Sophisticated Loader 2020)(Citation: SCILabs Malteiro 2021)","relationship_id":"relationship--56aab689-f68d-4a38-a814-d9a54d04093d","references":[{"source_name":"Segurança Informática URSA Sophisticated Loader 2020","description":"Pedro Tavares (Segurança Informática). (2020, September 15). Threat analysis: The emergent URSA trojan impacts many countries using a sophisticated loader. Retrieved March 13, 2024.","url":"https://seguranca-informatica.pt/threat-analysis-the-emergent-ursa-trojan-impacts-many-countries-using-a-sophisticated-loader/"},{"source_name":"SCILabs Malteiro 2021","description":"SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}]},{"id":"S1129","name":"Akira","url":"https://attack.mitre.org/software/S1129","kind":"malware","description":"[Akira](https://attack.mitre.org/software/S1129) executes native Windows functions such as <code>GetFileAttributesW</code> and `GetSystemInfo`.(Citation: Kersten Akira 2023)","relationship_id":"relationship--a4daf827-18c5-4866-86da-97bc8c77ca99","references":[{"source_name":"Kersten Akira 2023","description":"Max Kersten & Alexandre Mundo. (2023, November 29). Akira Ransomware. Retrieved April 4, 2024.","url":"https://www.trellix.com/blogs/research/akira-ransomware/"}]},{"id":"S1139","name":"INC Ransomware","url":"https://attack.mitre.org/software/S1139","kind":"malware","description":"[INC Ransomware](https://attack.mitre.org/software/S1139) can use the API `DeviceIoControl` to resize the allocated space for and cause the deletion of volume shadow copy snapshots.(Citation: Cybereason INC Ransomware November 2023)","relationship_id":"relationship--32285265-97d8-4d93-b601-ade0155b2a9e","references":[{"source_name":"Cybereason INC Ransomware November 2023","description":"Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"}]},{"id":"S1145","name":"Pikabot","url":"https://attack.mitre.org/software/S1145","kind":"malware","description":"[Pikabot](https://attack.mitre.org/software/S1145) uses native Windows APIs to determine if the process is being debugged and analyzed, such as `CheckRemoteDebuggerPresent`, `NtQueryInformationProcess`, `ProcessDebugPort`, and `ProcessDebugFlags`.(Citation: Zscaler Pikabot 2023) Other [Pikabot](https://attack.mitre.org/software/S1145) variants populate a global list of Windows API addresses from the `NTDLL` and `KERNEL32` libraries, and references these items instead of calling the API items to obfuscate execution.(Citation: Elastic Pikabot 2024)","relationship_id":"relationship--6e9b093c-a8c4-4da8-ac07-3e019ce9e16e","references":[{"source_name":"Zscaler Pikabot 2023","description":"Brett Stone-Gross & Nikolaos Pantazopoulos. (2023, May 24). Technical Analysis of Pikabot. Retrieved July 12, 2024.","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot"},{"source_name":"Elastic Pikabot 2024","description":"Daniel Stepanic & Salim Bitam. (2024, February 23). PIKABOT, I choose you!. Retrieved July 12, 2024.","url":"https://www.elastic.co/security-labs/pikabot-i-choose-you"}]},{"id":"S1149","name":"CHIMNEYSWEEP","url":"https://attack.mitre.org/software/S1149","kind":"malware","description":"[CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) can use Windows APIs including `LoadLibrary` and `GetProcAddress`.(Citation: Mandiant ROADSWEEP August 2022)","relationship_id":"relationship--376f951c-844c-474b-b805-7f36caa07579","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1151","name":"ZeroCleare","url":"https://attack.mitre.org/software/S1151","kind":"malware","description":"[ZeroCleare](https://attack.mitre.org/software/S1151) can call the `GetSystemDirectoryW` API to locate the system directory.(Citation: Mandiant ROADSWEEP August 2022)","relationship_id":"relationship--6feff8fd-f787-4afd-9503-93598e22f02b","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1152","name":"IMAPLoader","url":"https://attack.mitre.org/software/S1152","kind":"malware","description":"[IMAPLoader](https://attack.mitre.org/software/S1152) imports native Windows APIs such as `GetConsoleWindow` and `ShowWindow`.(Citation: PWC Yellow Liderc 2023)","relationship_id":"relationship--3301326d-45dd-4c42-9f2b-9e1123cde08e","references":[{"source_name":"PWC Yellow Liderc 2023","description":"PwC Threat Intelligence. (2023, October 25). Yellow Liderc ships its scripts and delivers IMAPLoader malware. Retrieved August 14, 2024.","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"}]},{"id":"S1160","name":"Latrodectus","url":"https://attack.mitre.org/software/S1160","kind":"malware","description":"[Latrodectus](https://attack.mitre.org/software/S1160) has used multiple Windows API post exploitation including `GetAdaptersInfo`, `CreateToolhelp32Snapshot`, and `CreateProcessW`.(Citation: Elastic Latrodectus May 2024)(Citation: Bitsight Latrodectus June 2024)","relationship_id":"relationship--948eb193-9037-43cf-99db-5d7912277ed0","references":[{"source_name":"Bitsight Latrodectus June 2024","description":"Batista, J. (2024, June 17). Latrodectus, are you coming back?. Retrieved September 13, 2024.","url":"https://www.bitsight.com/blog/latrodectus-are-you-coming-back"},{"source_name":"Elastic Latrodectus May 2024","description":"Stepanic, D. and Bousseaden, S. (2024, May 15). Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID. Retrieved September 13, 2024.","url":"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"}]},{"id":"S1169","name":"Mango","url":"https://attack.mitre.org/software/S1169","kind":"malware","description":"[Mango](https://attack.mitre.org/software/S1169) has the ability to use Native APIs.(Citation: ESET OilRig Campaigns Sep 2023)","relationship_id":"relationship--daba0b38-d4f8-4091-a804-b70d90eed8c7","references":[{"source_name":"ESET OilRig Campaigns Sep 2023","description":"Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}]},{"id":"S1170","name":"ODAgent","url":"https://attack.mitre.org/software/S1170","kind":"malware","description":"[ODAgent](https://attack.mitre.org/software/S1170) can pass commands using native APIs.(Citation: ESET OilRig Downloaders DEC 2023)","relationship_id":"relationship--55cadf96-99c1-4f37-8ef6-8c846ee74ade","references":[{"source_name":"ESET OilRig Downloaders DEC 2023","description":"Hromcova, Z. and Burgher, A. (2023, December 14). OilRig’s persistent attacks using cloud service-powered downloaders. Retrieved November 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"}]},{"id":"S1172","name":"OilBooster","url":"https://attack.mitre.org/software/S1172","kind":"malware","description":"[OilBooster](https://attack.mitre.org/software/S1172) has used the `ShowWindow` and `CreateProcessW` APIs.(Citation: ESET OilRig Downloaders DEC 2023)","relationship_id":"relationship--fd492de4-85fc-42a3-a499-d49d55c3b252","references":[{"source_name":"ESET OilRig Downloaders DEC 2023","description":"Hromcova, Z. and Burgher, A. (2023, December 14). OilRig’s persistent attacks using cloud service-powered downloaders. Retrieved November 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"}]},{"id":"S1179","name":"Exbyte","url":"https://attack.mitre.org/software/S1179","kind":"malware","description":"[Exbyte](https://attack.mitre.org/software/S1179) calls `ShellExecuteW` with the `IpOperation` parameter `RunAs` to launch `explorer.exe` with elevated privileges.(Citation: Microsoft BlackByte 2023)","relationship_id":"relationship--0125d222-8e17-44eb-b89b-6d795607e81f","references":[{"source_name":"Microsoft BlackByte 2023","description":"Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"id":"S1180","name":"BlackByte Ransomware","url":"https://attack.mitre.org/software/S1180","kind":"malware","description":"[BlackByte Ransomware](https://attack.mitre.org/software/S1180) uses the `SetThreadExecutionState` API to prevent the victim system from entering sleep.(Citation: Trustwave BlackByte 2021)","relationship_id":"relationship--c3cf7bd6-e8cf-4800-a7eb-82a8b1fcb14d","references":[{"source_name":"Trustwave BlackByte 2021","description":"Rodel Mendrez & Lloyd Macrohon. (2021, October 15). BlackByte Ransomware – Pt. 1 In-depth Analysis. Retrieved December 16, 2024.","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"}]},{"id":"S1190","name":"Kapeka","url":"https://attack.mitre.org/software/S1190","kind":"malware","description":"[Kapeka](https://attack.mitre.org/software/S1190) utilizes WinAPI calls to gather victim system information.(Citation: WithSecure Kapeka 2024)","relationship_id":"relationship--d9c5a382-bb4b-455c-bddf-ed345d02209d","references":[{"source_name":"WithSecure Kapeka 2024","description":"Mohammad Kazem Hassan Nejad, WithSecure. (2024, April 17). KAPEKA A novel backdoor spotted in Eastern Europe. Retrieved January 6, 2025.","url":"https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Research-Kapeka.pdf"}]},{"id":"S1200","name":"StealBit","url":"https://attack.mitre.org/software/S1200","kind":"malware","description":"[StealBit](https://attack.mitre.org/software/S1200) can use native APIs including `LoadLibraryExA` for execution and `NtSetInformationProcess` for defense evasion purposes.(Citation: Cybereason StealBit Exfiltration Tool)","relationship_id":"relationship--83aab8bd-08b0-4f18-b78d-fe5f071902fe","references":[{"source_name":"Cybereason StealBit Exfiltration Tool","description":"Cybereason Global SOC Team. (n.d.). THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool. Retrieved January 29, 2025.","url":"https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool"}]},{"id":"S1202","name":"LockBit 3.0","url":"https://attack.mitre.org/software/S1202","kind":"malware","description":"[LockBit 3.0](https://attack.mitre.org/software/S1202) has the ability to directly call native Windows API items during execution.(Citation: Sentinel Labs LockBit 3.0 JUL 2022)(Citation: INCIBE-CERT LockBit MAR 2024)","relationship_id":"relationship--4c90355d-1d51-41b1-ad7a-e62537483a90","references":[{"source_name":"INCIBE-CERT LockBit MAR 2024","description":"INCIBE-CERT. (2024, March 14). LockBit: response and recovery actions. Retrieved February 5, 2025.","url":"https://www.incibe.es/en/incibe-cert/blog/lockbit-response-and-recovery-actions"},{"source_name":"Sentinel Labs LockBit 3.0 JUL 2022","description":"Walter, J. (2022, July 21). LockBit 3.0 Update | Unpicking the Ransomware’s Latest Anti-Analysis and Evasion Techniques. Retrieved February 5, 2025.","url":"https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques"}]},{"id":"S1207","name":"XLoader","url":"https://attack.mitre.org/software/S1207","kind":"malware","description":"[XLoader](https://attack.mitre.org/software/S1207) uses the native Windows API for functionality, including defense evasion.(Citation: Zscaler XLoader 2025)","relationship_id":"relationship--859617aa-d2df-4db0-8b4a-d2be172787a6","references":[{"source_name":"Zscaler XLoader 2025","description":"Zscaler Threatlabz. (2025, January 27). Technical Analysis of Xloader Versions 6 and 7 | Part 1. Retrieved March 11, 2025.","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-xloader-versions-6-and-7-part-1"}]},{"id":"S1210","name":"Sagerunex","url":"https://attack.mitre.org/software/S1210","kind":"malware","description":"[Sagerunex](https://attack.mitre.org/software/S1210) calls the `WaitForSingleObject` API function as part of time-check logic.(Citation: Cisco LotusBlossom 2025)","relationship_id":"relationship--463f6f75-0bcf-4cee-ae3f-8a7ad2776721","references":[{"source_name":"Cisco LotusBlossom 2025","description":"Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025.","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"id":"S1226","name":"BOOKWORM","url":"https://attack.mitre.org/software/S1226","kind":"malware","description":"[BOOKWORM](https://attack.mitre.org/software/S1226) has used various Windows API calls during execution and defense evasion.(Citation: Broadcom) (Citation: Palo Alto Networks, Unit 42) [BOOKWORM](https://attack.mitre.org/software/S1226) has created a buffer on the heap using `HeapCreate` and `HeapAlloc` which allows for copying of shell code and then execution on the heap is initiated through callback function of legitimate API functions such as `EnumChildWindows` or `EnumSystemLanguageGroupsA`. (Citation: Palo Alto Networks, Unit 42)","relationship_id":"relationship--9093e0ad-88a0-4575-8c31-3da712820947","references":[{"source_name":"Broadcom","description":"Broadcom Protection Bulletins. (2025, February 20). Bookworm malware linked to Fireant (aka Stately Tarurus) activity observed in Southeast Asia. Retrieved July 21, 2025.","url":"https://www.broadcom.com/support/security-center/protection-bulletin/bookworm-malware-linked-to-fireant-aka-stately-tarurus-activity-observed-in-southeast-asia"},{"source_name":"Palo Alto Networks, Unit 42","description":"Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.","url":"https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"}]},{"id":"S1227","name":"StarProxy","url":"https://attack.mitre.org/software/S1227","kind":"malware","description":"[StarProxy](https://attack.mitre.org/software/S1227) has used native windows API calls such as `GetLocalTime()` to retrieve system data.(Citation: Zscaler)","relationship_id":"relationship--62c26c33-a177-4ab6-b070-6157c3528b9e","references":[{"source_name":"Zscaler","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}]},{"id":"S1228","name":"PUBLOAD","url":"https://attack.mitre.org/software/S1228","kind":"malware","description":"[PUBLOAD](https://attack.mitre.org/software/S1228) has used various Windows API calls during execution, when establishing persistence and defense evasion.(Citation: Lab52 MUSTANG PANDA PUBLOAD MAY 2023)(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA) [PUBLOAD](https://attack.mitre.org/software/S1228) stager leveraged Windows API functions with callback including `GrayStringW`, `EnumDateFormatsA`, and `LineDDA` to bypass anti-virus monitoring. (Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload) [PUBLOAD](https://attack.mitre.org/software/S1228) has also utilized other native windows API functions with callback functions such as `EnumChildWindows` and `EnumSystemLanguageGroupsA`. (Citation: Palo Alto Networks, Unit 42)","relationship_id":"relationship--921bebc2-f400-4eaa-8b9d-504221958e76","references":[{"source_name":"Lab52 MUSTANG PANDA PUBLOAD MAY 2023","description":"Dex. (n.d.). New Mustang Panda’s campaing against Australia. Retrieved August 4, 2025.","url":"https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"},{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","description":"Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","description":"Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source_name":"Palo Alto Networks, Unit 42","description":"Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.","url":"https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"}]},{"id":"S1229","name":"Havoc","url":"https://attack.mitre.org/software/S1229","kind":"malware","description":"[Havoc](https://attack.mitre.org/software/S1229) can use `NtAllocateVirtualMemory` and `NtCreateThreadEx` to aid process injection.(Citation: Havoc Framework Documentation)","relationship_id":"relationship--f2f1e84a-d6c2-460b-bc80-a90366f22b42","references":[{"source_name":"Havoc Framework Documentation","description":"Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.","url":"https://havocframework.com/docs/welcome"}]},{"id":"S1232","name":"SplatDropper","url":"https://attack.mitre.org/software/S1232","kind":"malware","description":"[SplatDropper](https://attack.mitre.org/software/S1232) has utilized hashed Native Windows API calls.(Citation: Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025)","relationship_id":"relationship--20d9e1a0-835e-4aaf-80d0-4db5ad4d8dae","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}]},{"id":"S1233","name":"PAKLOG","url":"https://attack.mitre.org/software/S1233","kind":"malware","description":"[PAKLOG](https://attack.mitre.org/software/S1233) has used Windows API `SetWindowsHookExW` with `idHook` set to `WH_KEYBOARD_LL` and a custom hook procedure to support its keylogging functions.(Citation: Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025)","relationship_id":"relationship--823efa1c-11e9-4ed3-9264-40ab74f1d0f9","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}]},{"id":"S1234","name":"SplatCloak","url":"https://attack.mitre.org/software/S1234","kind":"malware","description":"[SplatCloak](https://attack.mitre.org/software/S1234) has utilized Native Windows API calls dynamically through `ZwQuerySystemInformation`.(Citation: Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025)","relationship_id":"relationship--cd518b36-513f-44d8-b7c9-7462fe5b3902","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}]},{"id":"S1236","name":"CLAIMLOADER","url":"https://attack.mitre.org/software/S1236","kind":"malware","description":"[CLAIMLOADER](https://attack.mitre.org/software/S1236) has used various Windows API calls during execution, when establishing persistence and defense evasion.(Citation: IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025)(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)  [CLAIMLOADER](https://attack.mitre.org/software/S1236) has also leveraged the legitimate API functions to run its shellcode through the callback function, including `GetDC()` and `EnumFontsW()`.(Citation: IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025)  [CLAIMLOADER](https://attack.mitre.org/software/S1236) established persistence by utilizing the API `SHSetValue()`.(Citation: IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025) [CLAIMLOADER](https://attack.mitre.org/software/S1236) has utilized APIs with callback functions such as `EnumpropsExW`, `EnumSystemLanguageGroupsA`, and `EnumCalendarInfoExW`.(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)","relationship_id":"relationship--31d36371-b38c-4391-baf9-3b72056c520d","references":[{"source_name":"IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025","description":"Golo Muhr, Joshua Chung. (2025, June 23). Hive0154 aka Mustang Panda shifts focus on Tibetan community to deploy Pubload backdoor. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"},{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","description":"Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"}]},{"id":"S1237","name":"CANONSTAGER","url":"https://attack.mitre.org/software/S1237","kind":"malware","description":"[CANONSTAGER](https://attack.mitre.org/software/S1237) has leveraged Native API calls to execute code within the victim’s system including `GetCurrentDirectoryW`, `RegisterClassW` and `CreateWindowExW`.(Citation: Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025) [CANONSTAGER](https://attack.mitre.org/software/S1237) also created a new overlapped window that initiates callback functions to a windows procedure that processes Windows messages until a designated message type of 0x0018 WM_SHOWWINDOW is observed which then initiates the deployment of a subsequent malicious payload.(Citation: Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025)","relationship_id":"relationship--f778f413-7c3c-4265-8e3c-5fc4d538dd64","references":[{"source_name":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","description":"Patrick Whitsell. (2025, August 25). Deception in Depth: PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats. Retrieved September 9, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"}]},{"id":"S1239","name":"TONESHELL","url":"https://attack.mitre.org/software/S1239","kind":"malware","description":"[TONESHELL](https://attack.mitre.org/software/S1239) has utilized Native Windows API functions such as `WriteProcessMemory` and `CreateRemoteThreadEx`.(Citation: Trend Micro Mustang Panda Earth Preta Toneshell February 2025) [TONESHELL](https://attack.mitre.org/software/S1239) has also utilized Windows API functions for creating seed values including `CoCreateGuid` and `GetTickCount`.(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)(Citation: Zscaler) [TONESHELL](https://attack.mitre.org/software/S1239) has leveraged the legitimate API function `EnumSystemLocalesA` to run its shellcode through the callback function.(Citation: Palo Alto Networks, Unit 42)  ","relationship_id":"relationship--d55c917d-0728-4e09-a58b-672094786e40","references":[{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","description":"Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"Trend Micro Mustang Panda Earth Preta Toneshell February 2025","description":"Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.","url":"https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"},{"source_name":"Palo Alto Networks, Unit 42","description":"Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.","url":"https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"},{"source_name":"Zscaler","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}]},{"id":"S1242","name":"Qilin","url":"https://attack.mitre.org/software/S1242","kind":"malware","description":"[Qilin](https://attack.mitre.org/software/S1242) can attempt to log on to the local computer via `LogonUserW` and use `GetLogicalDrives()` and `EnumResourceW()` for discovery.(Citation: Trend Micro Agenda Ransomware AUG 2022)(Citation: Halcyon Qilin.B OCT 2024)","relationship_id":"relationship--41b41a39-ff5f-433d-9e2a-3dad3b00d74e","references":[{"source_name":"Halcyon Qilin.B OCT 2024","description":"Halcyon RISE Team. (2024, October 24). New Qilin.B Ransomware Variant Boasts Enhanced Encryption and Defense Evasion. Retrieved September 26, 2025.","url":"https://www.halcyon.ai/blog/new-qilin-b-ransomware-variant-boasts-enhanced-encryption-and-defense-evasion"},{"source_name":"Trend Micro Agenda Ransomware AUG 2022","description":"Magdy, S. et al. (2022, August 25). New Golang Ransomware Agenda Customizes Attacks. Retrieved September 26, 2025.","url":"https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html"}]},{"id":"S1244","name":"Medusa Ransomware","url":"https://attack.mitre.org/software/S1244","kind":"malware","description":"[Medusa Ransomware](https://attack.mitre.org/software/S1244) has leveraged Windows Native API functions to execute payloads.(Citation: Security Scorecard Medusa Ransomware January 2024)","relationship_id":"relationship--777f1f3f-f996-45e9-85e0-f063901c1289","references":[{"source_name":"Security Scorecard Medusa Ransomware January 2024","description":"Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"id":"S1247","name":"Embargo","url":"https://attack.mitre.org/software/S1247","kind":"malware","description":"[Embargo](https://attack.mitre.org/software/S1247) has leveraged Windows Native API functions to execute its operations.(Citation: Cyble Embargo Ransomware May 2024)","relationship_id":"relationship--355133f7-9499-409f-9215-5c8f0756bd2d","references":[{"source_name":"Cyble Embargo Ransomware May 2024","description":"Cyble. (2024, May 24). The Rust Revolution: New Embargo Ransomware Steps In. Retrieved October 19, 2025.","url":"https://cyble.com/blog/the-rust-revolution-new-embargo-ransomware-steps-in/"}]},{"id":"S9001","name":"SystemBC","url":"https://attack.mitre.org/software/S9001","kind":"malware","description":"[SystemBC](https://attack.mitre.org/software/S9001) has utilized native Windows API functions such as `EnumWindows`and `GetVolumeInformationA` during discovery activities.(Citation: SophosGnGal_SystemBC_Dec2020)  ","relationship_id":"relationship--355975ea-f7ae-4ae9-9b76-9a90c1b620c8","references":[{"source_name":"SophosGnGal_SystemBC_Dec2020","description":"Gallagher, S., Gn, S. (2020, December 16). Ransomware operators use SystemBC RAT as off-the-shelf Tor backdoor. Retrieved May 16, 2025.","url":"https://news.sophos.com/en-us/2020/12/16/systembc/"}]},{"id":"S9007","name":"HTTPTroy","url":"https://attack.mitre.org/software/S9007","kind":"malware","description":"[HTTPTroy](https://attack.mitre.org/software/S9007) has leveraged Windows Native API calls, including `GetProcAddress` to execute functions in memory.(Citation: Gen Digital Kimsuky HTTPTroy October 2025)","relationship_id":"relationship--c57537e2-2b0e-4024-99fd-41b8aa1e7b07","references":[{"source_name":"Gen Digital Kimsuky HTTPTroy October 2025","description":"Alexndru-Cristian Bardas. (2025, October 30). DPRK’s Playbook: Kimsuky’s HttpTroy and Lazarus’s New BLINDINGCAN Variant. Retrieved April 8, 2026.","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"}]},{"id":"S9012","name":"TRAILBLAZE","url":"https://attack.mitre.org/software/S9012","kind":"malware","description":"[TRAILBLAZE](https://attack.mitre.org/software/S9012) has leveraged raw syscalls to execute commands.(Citation: Google UNC5221 Ivanti April 2025)(Citation: Picus Security UNC5221 Ivanti May 2025)","relationship_id":"relationship--f82035fe-b423-405c-944a-0b4c117ec68c","references":[{"source_name":"Google UNC5221 Ivanti April 2025","description":"John Wolfram, Michael Edie, Jacob Thompson, Matt Lin, Josh Murchie. (2025, April 3). Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457). Retrieved April 13, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability"},{"source_name":"Picus Security UNC5221 Ivanti May 2025","description":"Sila Ozeren Hacioglu. (2025, May 5). UNC5221’s Latest Exploit: Weaponizing CVE-2025-22457 in Ivanti Connect Secure. Retrieved April 13, 2026.","url":"https://www.picussecurity.com/resource/blog/unc5221-cve-2025-22457-ivanti-connect-secure"}]},{"id":"S9016","name":"Caminho","url":"https://attack.mitre.org/software/S9016","kind":"malware","description":"[Caminho](https://attack.mitre.org/software/S9016) can use `System.Net.WebClient.downloadString()` for file download.(Citation: Zscaler BlindEagle DEC 2025)","relationship_id":"relationship--de362038-1c20-4e62-a515-d251a20ce5e5","references":[{"source_name":"Zscaler BlindEagle DEC 2025","description":"Pellegrino, G. (2025, December 16). BlindEagle Targets Colombian Government Agency with Caminho and DCRAT. Retrieved April 16, 2026.","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"}]},{"id":"S9018","name":"HeartCrypt","url":"https://attack.mitre.org/software/S9018","kind":"malware","description":"[HeartCrypt](https://attack.mitre.org/software/S9018) can use Windows API functions to modify the Registry and `FindResourceW`, `LoadResource`, and `LockResource` to acquire a pointer to corresponding code resources.(Citation: Palo Alto HeartCrypt DEC 2024)","relationship_id":"relationship--bee2287d-9e33-4757-b6af-e0dba4a7bb14","references":[{"source_name":"Palo Alto HeartCrypt DEC 2024","description":"Tujague, J., Bunce, D. (n.d.). Crypted Hearts: Exposing the HeartCrypt Packer-as-a-Service Operation. Retrieved April 16, 2026.","url":"https://unit42.paloaltonetworks.com/packer-as-a-service-heartcrypt-malware/"}]},{"id":"S9020","name":"LODEINFO","url":"https://attack.mitre.org/software/S9020","kind":"malware","description":"[LODEINFO](https://attack.mitre.org/software/S9020) can use Windows APIs such as `VirtualAllocEx()`, `WriteProcessMemory()`, `CreateRemoteThread()`, `NtAllocateVirtualMemory()`, `NtWriteVirtualMemory()`, and `RtlCreateUserThread()` to enable memory injection of shellcode.(Citation: Kaspersky LODEINFO Part II OCT 2022)","relationship_id":"relationship--973856a0-43cf-49c7-9322-a7203834464c","references":[{"source_name":"Kaspersky LODEINFO Part II OCT 2022","description":"Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part II. Retrieved April 17, 2026.","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/"}]},{"id":"S9021","name":"DOWNIISSA","url":"https://attack.mitre.org/software/S9021","kind":"malware","description":"[DOWNIISSA](https://attack.mitre.org/software/S9021) can use the `URLDownloadToFileA()` API to download from remote resources.(Citation: Kaspersky LODEINFO OCT 2022)","relationship_id":"relationship--fa6f51f8-218b-41ce-bdd9-4e15df864667","references":[{"source_name":"Kaspersky LODEINFO OCT 2022","description":"Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part I. Retrieved April 17, 2026.","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/"}]},{"id":"S9025","name":"NOOPLDR","url":"https://attack.mitre.org/software/S9025","kind":"malware","description":"[NOOPLDR](https://attack.mitre.org/software/S9025) can use native APIs `NtProtectVirtualMemory`, `NtWriteVirtualMemory`, and `NtCreateThreadEx` to aid process injection.(Citation: Trend Micro Earth Kasha NOV 2024)","relationship_id":"relationship--a39f5af3-f365-4338-8c38-366225241fa7","references":[{"source_name":"Trend Micro Earth Kasha NOV 2024","description":"Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"id":"S9027","name":"ANELLDR","url":"https://attack.mitre.org/software/S9027","kind":"malware","description":"[ANELLDR](https://attack.mitre.org/software/S9027) can use the `ZwSetInformationThread` to enable debugger evasion.(Citation: Trend Micro Earth Kasha Anel NOV 2024)\n","relationship_id":"relationship--3020712a-95b1-4f23-9a24-68a2b401ae97","references":[{"source_name":"Trend Micro Earth Kasha Anel NOV 2024","description":"Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"}]},{"id":"S9032","name":"MuddyViper","url":"https://attack.mitre.org/software/S9032","kind":"malware","description":"[MuddyViper](https://attack.mitre.org/software/S9032) has the ability to relaunch itself using the `CreateProcessW` API.(Citation: ESET_MuddyWater_Dec2025)     ","relationship_id":"relationship--77811f16-814c-45e5-b922-1b2be86239d3","references":[{"source_name":"ESET_MuddyWater_Dec2025","description":"ESET Research. (2025, December 2). MuddyWater: Snakes by the riverbank. Retrieved February 17, 2026.","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}]},{"id":"S9033","name":"Fooder","url":"https://attack.mitre.org/software/S9033","kind":"malware","description":"[Fooder](https://attack.mitre.org/software/S9033) has used the WinCrypt API for payload decryption, `DuplicateTokenEx` to duplicate the token of a specified process, and `CreateProcessAsUserA` for payload execution.(Citation: ESET_MuddyWater_Dec2025)        ","relationship_id":"relationship--6d20f944-c10f-4386-ae3d-fdb349cbd99b","references":[{"source_name":"ESET_MuddyWater_Dec2025","description":"ESET Research. (2025, December 2). MuddyWater: Snakes by the riverbank. Retrieved February 17, 2026.","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}]},{"id":"S9036","name":"LP-Notes","url":"https://attack.mitre.org/software/S9036","kind":"malware","description":"[LP-Notes](https://attack.mitre.org/software/S9036) has used the `ImpersonateLoggedOnUser` API to impersonate the security context of the taskhostw.exe process.(Citation: ESET_MuddyWater_Dec2025) Additionally, [LP-Notes](https://attack.mitre.org/software/S9036) has also used the `CredUIPromptForWindowsCredentialsW` API to obtain Windows credentials.(Citation: ESET_MuddyWater_Dec2025)","relationship_id":"relationship--226fb240-24c2-4eb6-ac1b-c9c60712371c","references":[{"source_name":"ESET_MuddyWater_Dec2025","description":"ESET Research. (2025, December 2). MuddyWater: Snakes by the riverbank. Retrieved February 17, 2026.","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"}]},{"id":"S9037","name":"RustyWater","url":"https://attack.mitre.org/software/S9037","kind":"malware","description":"[RustyWater](https://attack.mitre.org/software/S9037) has used `CreateObject` to instantiate a WScript.Shell Component Object Model (COM) object.(Citation: CloudSEK_RustyWater_Jan2026)  Additionally, [RustyWater](https://attack.mitre.org/software/S9037) has used `VirtualAllocEx` and `WriteProcessMemory` to inject shellcode into explorer.exe.(Citation: CloudSEK_RustyWater_Jan2026)      ","relationship_id":"relationship--3d32732f-e0ca-4ec7-833a-2eae547c2c44","references":[{"source_name":"CloudSEK_RustyWater_Jan2026","description":"Awasthi, P. (2026, January 8). Reborn in Rust: Muddy Water Evolves Tooling with RustyWater Implant. Retrieved March 19, 2026.","url":"https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"}]},{"id":"S9038","name":"DynoWiper","url":"https://attack.mitre.org/software/S9038","kind":"malware","description":"[DynoWiper](https://attack.mitre.org/software/S9038) has used multiple native Windows functions, such as `GetLogicalDrives` and `FindNextFile` for discovery and file deletion.(Citation: CERT Polska)(Citation: ESET DynoWiper Update JAN 2026)","relationship_id":"relationship--80bf6361-8d29-4f25-8b76-64a3751686ed","references":[{"source_name":"CERT Polska","description":"CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"},{"source_name":"ESET DynoWiper Update JAN 2026","description":"ESET. (2026, January 30). DynoWiper update: Technical analysis and attribution. Retrieved April 22, 2026.","url":"https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/"}]},{"id":"S9050","name":"Vidar","url":"https://attack.mitre.org/software/S9050","kind":"malware","description":"[Vidar](https://attack.mitre.org/software/S9050) has used native Windows functions, such as `LoadLibraryExW`, for discovery and execution.(Citation: Cyfirma_Vidar_June2024)","relationship_id":"relationship--dc813360-db9a-4de2-883c-a9e0b5e959fa","references":[{"source_name":"Cyfirma_Vidar_June2024","description":"CYFIRMA. (2024, June 3). Vidar Stealer: An In-depth Analysis of an Information-Stealing Malware. Retrieved August 13, 2026.","url":"https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"}]},{"id":"S9051","name":"The Gentlemen Ransomware","url":"https://attack.mitre.org/software/S9051","kind":"malware","description":"[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has utilized Windows APIs to facility network share discovery actions.(Citation: CheckPointResearch_TheGentlemen_April2026) ","relationship_id":"relationship--432e1354-11a0-4ade-9874-58fa3194b0d1","references":[{"source_name":"CheckPointResearch_TheGentlemen_April2026","description":"Check Point Research. (2026, April 20). DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy. Retrieved September 18, 2026.","url":"https://research.checkpoint.com/2026/dfir-report-the-gentlemen/"}]},{"id":"S9053","name":"MiniJunk","url":"https://attack.mitre.org/software/S9053","kind":"malware","description":"[MiniJunk](https://attack.mitre.org/software/S9053) has utilized Windows API calls to make HTTPs requests to C2.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ","relationship_id":"relationship--166d3d7e-8bba-49ea-b84e-5944fdf717e0","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","description":"Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026.","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}]},{"id":"S9057","name":"CRASHPAD","url":"https://attack.mitre.org/software/S9057","kind":"malware","description":"[CRASHPAD](https://attack.mitre.org/software/S9057) has leveraged Windows Native API, such as `CryptUnprotectData`, to decrypt functions.(Citation: Mandiant_UNC1549_Nov2025) ","relationship_id":"relationship--94761ec9-fd5f-473f-8410-55848d8c5f97","references":[{"source_name":"Mandiant_UNC1549_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]},{"id":"S9058","name":"SIGHTGRAB","url":"https://attack.mitre.org/software/S9058","kind":"malware","description":"[SIGHTGRAB](https://attack.mitre.org/software/S9058) has leveraged Windows Native API keys to execute functions to include `LoadLibraryA` and `GetProcessAddress`.(Citation: Mandiant_UNC1549_Nov2025) ","relationship_id":"relationship--34fdbe2b-27c4-4f3e-9372-0ced2e9c4140","references":[{"source_name":"Mandiant_UNC1549_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]},{"id":"S9061","name":"LIGHTRAIL","url":"https://attack.mitre.org/software/S9061","kind":"malware","description":"[LIGHTRAIL](https://attack.mitre.org/software/S9061) has leveraged Windows API calls to establish the WebSocket to include `WinHTTP`.(Citation: Mandiant_UNC1549TTPsTools_Nov2025) ","relationship_id":"relationship--4c141056-f1ee-46f9-9fdc-de576094ac65","references":[{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]},{"id":"S9067","name":"TWOSTROKE","url":"https://attack.mitre.org/software/S9067","kind":"malware","description":"[TWOSTROKE](https://attack.mitre.org/software/S9067) has leveraged Windows API calls to gather system information using `GetComputerNameExW(ComputerNameDnsFullyQualified)`.(Citation: Mandiant_UNC1549_Nov2025)","relationship_id":"relationship--ae9723db-6a3b-46cb-92ef-b6a50b9893c7","references":[{"source_name":"Mandiant_UNC1549_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"actors":[{"id":"G0010","name":"Turla","url":"https://attack.mitre.org/groups/G0010","kind":"intrusion-set","description":"[Turla](https://attack.mitre.org/groups/G0010) and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.(Citation: ESET Turla PowerShell May 2019)","relationship_id":"relationship--3465231b-93b2-47ea-8c4f-f1f7e9d9be1b","references":[{"source_name":"ESET Turla PowerShell May 2019","description":"Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"[Lazarus Group](https://attack.mitre.org/groups/G0032) has used the Windows API <code>ObtainUserAgentString</code> to obtain the User-Agent from a compromised host to connect to a C2 server.(Citation: McAfee Lazarus Jul 2020) [Lazarus Group](https://attack.mitre.org/groups/G0032) has also used various, often lesser known, functions to perform various types of Discovery and [Process Injection](https://attack.mitre.org/techniques/T1055).(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)","relationship_id":"relationship--2c131932-4632-4866-845f-212cbe29756d","references":[{"source_name":"McAfee Lazarus Jul 2020","description":"Cashman, M. (2020, July 29). Operation North Star Campaign. Retrieved December 20, 2021.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/?hilite=%27Operation%27%2C%27North%27%2C%27Star%27"},{"source_name":"Lazarus APT January 2022","description":"Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"Qualys LolZarus","description":"Pradhan, A. (2022, February 8). LolZarus: Lazarus Group Incorporating Lolbins into Campaigns. Retrieved March 22, 2022.","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}]},{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) uses [Prestige](https://attack.mitre.org/software/S1058) to disable and restore file system redirection by using the following functions:  `Wow64DisableWow64FsRedirection()` and `Wow64RevertWow64FsRedirection()`.(Citation: Microsoft Prestige ransomware October 2022)","relationship_id":"relationship--58bd61ef-fd0a-496c-9e13-5383d92eaac5","references":[{"source_name":"Microsoft Prestige ransomware October 2022","description":"MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"id":"G0045","name":"menuPass","url":"https://attack.mitre.org/groups/G0045","kind":"intrusion-set","description":"[menuPass](https://attack.mitre.org/groups/G0045) has used native APIs including <code>GetModuleFileName</code>, <code>lstrcat</code>, <code>CreateFile</code>, and <code>ReadFile</code>.(Citation: Symantec Cicada November 2020)","relationship_id":"relationship--7b59aa8f-d9d6-4bb5-b2ca-6fc1d36c1550","references":[{"source_name":"Symantec Cicada November 2020","description":"Symantec. (2020, November 17). Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign. Retrieved December 17, 2020.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) malware has used <code>CreateProcess</code> to launch additional malicious components.(Citation: ESET Gamaredon June 2020)(Citation: ESET Gamaredon Sept2024) ","relationship_id":"relationship--9c51f7a2-346b-4ef9-ade0-ac2c5c845c27","references":[{"source_name":"ESET Gamaredon June 2020","description":"Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source_name":"ESET Gamaredon Sept2024","description":"Rusnák, Z. (2024, September 26). Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023. Retrieved October 30, 2024.","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"}]},{"id":"G0067","name":"APT37","url":"https://attack.mitre.org/groups/G0067","kind":"intrusion-set","description":"[APT37](https://attack.mitre.org/groups/G0067) leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.(Citation: Talos Group123)","relationship_id":"relationship--82c9b9a1-5fbe-49e5-8685-12a03a66ef8d","references":[{"source_name":"Talos Group123","description":"Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"id":"G0078","name":"Gorgon Group","url":"https://attack.mitre.org/groups/G0078","kind":"intrusion-set","description":"[Gorgon Group](https://attack.mitre.org/groups/G0078) malware can leverage the Windows API call, CreateProcessA(), for execution.(Citation: Unit 42 Gorgon Group Aug 2018)","relationship_id":"relationship--304c0297-8d9e-41ee-a5c0-f8bd33bdcd2a","references":[{"source_name":"Unit 42 Gorgon Group Aug 2018","description":"Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"id":"G0081","name":"Tropic Trooper","url":"https://attack.mitre.org/groups/G0081","kind":"intrusion-set","description":"[Tropic Trooper](https://attack.mitre.org/groups/G0081) has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.(Citation: TrendMicro Tropic Trooper May 2020)","relationship_id":"relationship--73499911-3b9f-443e-b522-f0d1434f2eb6","references":[{"source_name":"TrendMicro Tropic Trooper May 2020","description":"Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) has used the Windows API to execute code within a victim's system.(Citation: CISA AA20-239A BeagleBoyz August 2020) ","relationship_id":"relationship--cad2a13a-eb81-4c1c-8d16-beac4bf79625","references":[{"source_name":"CISA AA20-239A BeagleBoyz August 2020","description":"DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"id":"G0090","name":"WIRTE","url":"https://attack.mitre.org/groups/G0090","kind":"intrusion-set","description":"[WIRTE](https://attack.mitre.org/groups/G0090) has used the `RtlIpv4StringToAddressA` to convert IP-formatted string to a byte array.(Citation: Check Point Wirte NOV 2024)\n","relationship_id":"relationship--c5a36e90-5145-44fc-99f9-edaa37a59cb6","references":[{"source_name":"Check Point Wirte NOV 2024","description":"Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}]},{"id":"G0091","name":"Silence","url":"https://attack.mitre.org/groups/G0091","kind":"intrusion-set","description":"[Silence](https://attack.mitre.org/groups/G0091) has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)","relationship_id":"relationship--fdedfad5-5cb7-436a-8522-6df3f6de42b1","references":[{"source_name":"SecureList Silence Nov 2017","description":"GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.","url":"https://securelist.com/the-silence/83009/"},{"source_name":"Group IB Silence Sept 2018","description":"Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"id":"G0092","name":"TA505","url":"https://attack.mitre.org/groups/G0092","kind":"intrusion-set","description":"[TA505](https://attack.mitre.org/groups/G0092) has deployed payloads that use Windows API calls on a compromised host.(Citation: Korean FSI TA505 2020)","relationship_id":"relationship--d7cfd2b5-c297-4000-b179-aca649a05f65","references":[{"source_name":"Korean FSI TA505 2020","description":"Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has utilized Native APIs to collect data from victim hosts and facilitate execution of malicious scripts.(Citation: Gen Digital Kimsuky HTTPTroy October 2025)(Citation: Aryaka Kimsuky July 2025)","relationship_id":"relationship--96f5cb23-3dc4-4690-b745-914e85b0c95e","references":[{"source_name":"Gen Digital Kimsuky HTTPTroy October 2025","description":"Alexndru-Cristian Bardas. (2025, October 30). DPRK’s Playbook: Kimsuky’s HttpTroy and Lazarus’s New BLINDINGCAN Variant. Retrieved April 8, 2026.","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"},{"source_name":"Aryaka Kimsuky July 2025","description":"Varadharajan Krishnasamy, Aditya K Sood. (2025, July 29). From Reconnaissance  to Control: The Operational Blueprint of Kimsuky APT  for Cyber Espionage. Retrieved April 18, 2026.","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"id":"G0098","name":"BlackTech","url":"https://attack.mitre.org/groups/G0098","kind":"intrusion-set","description":"[BlackTech](https://attack.mitre.org/groups/G0098) has used built-in API functions.(Citation: IronNet BlackTech Oct 2021)","relationship_id":"relationship--56f73ea6-f7ba-4226-bbf9-55e904843e31","references":[{"source_name":"IronNet BlackTech Oct 2021","description":"Demboski, M., et al. (2021, October 26). China cyber attacks: the current threat landscape. Retrieved March 25, 2022.","url":"https://www.ironnet.com/blog/china-cyber-attacks-the-current-threat-landscape"}]},{"id":"G0114","name":"Chimera","url":"https://attack.mitre.org/groups/G0114","kind":"intrusion-set","description":"[Chimera](https://attack.mitre.org/groups/G0114) has used direct Windows system calls by leveraging Dumpert.(Citation: Cycraft Chimera April 2020)","relationship_id":"relationship--3cf6afbd-a010-4982-8121-22e67ace6046","references":[{"source_name":"Cycraft Chimera April 2020","description":"Cycraft. (2020, April 15). APT Group Chimera - APT Operation Skeleton key Targets Taiwan Semiconductor Vendors. Retrieved August 24, 2020..","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"}]},{"id":"G0126","name":"Higaisa","url":"https://attack.mitre.org/groups/G0126","kind":"intrusion-set","description":"[Higaisa](https://attack.mitre.org/groups/G0126) has called various native OS APIs.(Citation: Zscaler Higaisa 2020)","relationship_id":"relationship--1489621a-59eb-42a9-b529-adc37c65520c","references":[{"source_name":"Zscaler Higaisa 2020","description":"Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"id":"G0129","name":"Mustang Panda","url":"https://attack.mitre.org/groups/G0129","kind":"intrusion-set","description":"[Mustang Panda](https://attack.mitre.org/groups/G0129) has used various Windows API calls during execution and defense evasion.(Citation: Eset PlugX Korplug Mustang Panda March 2022)(Citation: Broadcom)(Citation: Lab52 MUSTANG PANDA PUBLOAD MAY 2023)(Citation: IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025)(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)(Citation: Trend Micro Mustang Panda Earth Preta Toneshell February 2025)(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload)(Citation: Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025)(Citation: Palo Alto Networks, Unit 42)(Citation: Sophos Mustang Panda PLUGX)(Citation: Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025)(Citation: Zscaler)","relationship_id":"relationship--b6d01bfe-cff0-4dc1-90e5-0a9fac5d15a9","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","description":"Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Broadcom","description":"Broadcom Protection Bulletins. (2025, February 20). Bookworm malware linked to Fireant (aka Stately Tarurus) activity observed in Southeast Asia. Retrieved July 21, 2025.","url":"https://www.broadcom.com/support/security-center/protection-bulletin/bookworm-malware-linked-to-fireant-aka-stately-tarurus-activity-observed-in-southeast-asia"},{"source_name":"Lab52 MUSTANG PANDA PUBLOAD MAY 2023","description":"Dex. (n.d.). New Mustang Panda’s campaing against Australia. Retrieved August 4, 2025.","url":"https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"},{"source_name":"IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025","description":"Golo Muhr, Joshua Chung. (2025, June 23). Hive0154 aka Mustang Panda shifts focus on Tibetan community to deploy Pubload backdoor. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"},{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","description":"Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"Trend Micro Mustang Panda Earth Preta Toneshell February 2025","description":"Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.","url":"https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","description":"Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source_name":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","description":"Patrick Whitsell. (2025, August 25). Deception in Depth: PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats. Retrieved September 9, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"},{"source_name":"Palo Alto Networks, Unit 42","description":"Robert Falcone. (2025, February 20). Stately Taurus Activity in Southeast Asia Links to Bookworm Malware. Retrieved July 21, 2025.","url":"https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"},{"source_name":"Sophos Mustang Panda PLUGX","description":"Secureworks Counter Threat Unit Research Team. (2022, September 8). BRONZE PRESIDENT Targets Government Officials. Retrieved September 9, 2025.","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"},{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"},{"source_name":"Zscaler","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}]},{"id":"G1008","name":"SideCopy","url":"https://attack.mitre.org/groups/G1008","kind":"intrusion-set","description":" [SideCopy](https://attack.mitre.org/groups/G1008) has executed malware by calling the API function `CreateProcessW`.(Citation: MalwareBytes SideCopy Dec 2021)","relationship_id":"relationship--612cdeba-0ca3-426f-93d3-2dd3ccca7a54","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","description":"Threat Intelligence Team. (2021, December 2). SideCopy APT: Connecting lures victims, payloads to infrastructure. Retrieved June 13, 2022.","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"id":"G1022","name":"ToddyCat","url":"https://attack.mitre.org/groups/G1022","kind":"intrusion-set","description":"[ToddyCat](https://attack.mitre.org/groups/G1022) has used `WinExec` to execute commands received from C2 on compromised hosts.(Citation: Kaspersky ToddyCat Check Logs October 2023)","relationship_id":"relationship--7826256e-62c5-4580-80f0-3dae2916f4bd","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","description":"Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"id":"G1051","name":"Medusa Group","url":"https://attack.mitre.org/groups/G1051","kind":"intrusion-set","description":"[Medusa Group](https://attack.mitre.org/groups/G1051) has leveraged Windows Native API functions to execute payloads.(Citation: Security Scorecard Medusa Ransomware January 2024)","relationship_id":"relationship--0f4a9bce-7e94-4c6f-83b1-49f842aa42c9","references":[{"source_name":"Security Scorecard Medusa Ransomware January 2024","description":"Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"id":"G1059","name":"NIMBUS MANTICORE","url":"https://attack.mitre.org/groups/G1059","kind":"intrusion-set","description":"[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has utilized Native Windows API calls to execute on victim devices to include `GetModuleHandle`.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)   ","relationship_id":"relationship--13bcc487-1088-4f58-8d06-025a1c0522ed","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","description":"Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026.","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}]}],"mitigations":[{"id":"M1038","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M1038","kind":"course-of-action","description":"Identify and block potentially malicious software executed that may be executed through this technique by using application control (Citation: Beechey 2010) tools, like Windows Defender Application Control(Citation: Microsoft Windows Defender Application Control), AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)","relationship_id":"relationship--42f4db8f-ef8b-4dcc-8c8f-4d0b5219c8b7","references":[{"source_name":"Beechey 2010","description":"Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.","url":"http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599"},{"source_name":"Corio 2008","description":"Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved September 12, 2024.","url":"https://learn.microsoft.com/en-us/previous-versions/technet-magazine/cc510322(v=msdn.10)"},{"source_name":"Microsoft Windows Defender Application Control","description":"Gorzelany, A., Hall, J., Poggemeyer, L.. (2019, January 7). Windows Defender Application Control. Retrieved July 16, 2019.","url":"https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control"},{"source_name":"TechNet Applocker vs SRP","description":"Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.","url":"https://technet.microsoft.com/en-us/library/ee791851.aspx"},{"source_name":"NSA MS AppLocker","description":"NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016.","url":"https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm"},{"source_name":"Windows Commands JPCERT","description":"Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.","url":"https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"}]},{"id":"M1040","name":"Behavior Prevention on Endpoint","url":"https://attack.mitre.org/mitigations/M1040","kind":"course-of-action","description":"On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office VBA macros from calling Win32 APIs. (Citation: win10_asr)","relationship_id":"relationship--ba25a8ba-dc7a-4197-b885-d910524588b7","references":[{"source_name":"win10_asr","description":"Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.","url":"https://docs.microsoft.com/microsoft-365/security/defender-endpoint/attack-surface-reduction"}]}],"candidates":[{"id":"7ec5b74e-8289-4ff2-a162-b6f286a33abd","name":"WinPwn - Get SYSTEM shell - Bind System Shell using CreateProcess technique","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1106/T1106.yaml","description":"Get SYSTEM shell - Bind System Shell using CreateProcess technique via function of WinPwn","inputs":{},"dependencies":[],"source_definition_sha256":"abdf08e44a80dc0cac23a3e6b8c1e4f449c53dd3bc50a06aec2f65a1044829ad"},{"id":"99be2089-c52d-4a4a-b5c3-261ee42c8b62","name":"Execution through API - CreateProcess","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1106/T1106.yaml","description":"Execute program by leveraging Win32 API's. By default, this will launch calc.exe from the command prompt.","inputs":{"source_file":{"description":"Location of the CSharp source file to compile and execute","type":"path","default":"PathToAtomicsFolder\\T1106\\src\\CreateProcess.cs"},"output_file":{"description":"Location of the payload","type":"path","default":"%tmp%\\T1106.exe"}},"dependencies":[{"description":"#{source_file} must exist on system.\n"}],"source_definition_sha256":"406184f1fb1ecd8eee5846e080ba5e3ee754b353838352dfdbbe9f0675b27dd8"},{"id":"ae56083f-28d0-417d-84da-df4242da1f7c","name":"Run Shellcode via Syscall in Go","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1106/T1106.yaml","description":"Runs shellcode in the current running process via a syscall.\n\nSteps taken with this technique\n1. Allocate memory for the shellcode with VirtualAlloc setting the page permissions to Read/Write\n2. Use the RtlCopyMemory macro to copy the shellcode to the allocated memory space\n3. Change the memory page permissions to Execute/Read with VirtualProtect\n4. Use syscall to execute the entrypoint of the shellcode\n\n- PoC Credit: (https://github.com/Ne0nd0g/go-shellcode#syscall)\n","inputs":{},"dependencies":[],"source_definition_sha256":"737850910c2ef57ec483fa49df22a7ef14549dd0fbda1056e77536b2f03febc9"},{"id":"ce4e76e6-de70-4392-9efe-b281fc2b4087","name":"WinPwn - Get SYSTEM shell - Pop System Shell using CreateProcess technique","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1106/T1106.yaml","description":"Get SYSTEM shell - Pop System Shell using CreateProcess technique via function of WinPwn","inputs":{},"dependencies":[],"source_definition_sha256":"004a40b802ce74e4917aa17c4422cc5cca7723541cc7b8e52415c3c2c851f604"},{"id":"e1f93a06-1649-4f07-89a8-f57279a7d60e","name":"WinPwn - Get SYSTEM shell - Pop System Shell using NamedPipe Impersonation technique","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1106/T1106.yaml","description":"Get SYSTEM shell - Pop System Shell using NamedPipe Impersonation technique via function of WinPwn","inputs":{},"dependencies":[],"source_definition_sha256":"a8080c91d0db9c6c7781820554cb78b273ae79d7742de1904211b40203b0468b"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1059":"/ttp-simulation/techniques/enterprise/T1059/","T1685":"/ttp-simulation/techniques/enterprise/T1685/","T1106":"/ttp-simulation/techniques/enterprise/T1106/","T1055":"/ttp-simulation/techniques/enterprise/T1055/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1106","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}