{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0834","id":"T0834","name":"Native API","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0834","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"23cfb2a74eeaf894d87aa483fab8ad1b099dd1ac6fb4ac881566c7de6f4a797f","description":"Adversaries may directly interact with the native OS application programming interface (API) to access system functions. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. (Citation: The MITRE Corporation May 2017) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations. \n\nFunctionality provided by native APIs are often also exposed to user-mode applications via interfaces and libraries. For example, functions such as memcpy and direct operations on memory registers can be used to modify user and system memory space.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0834","external_id":"T0834"},{"source_name":"The MITRE Corporation May 2017","description":"The MITRE Corporation 2017, May 31 ATT&CK T1106: Native API Retrieved. 2021/04/26 ","url":"https://attack.mitre.org/techniques/T1106/"}],"platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0021","name":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component","category":"Application and service audit","description":"Instrumented operating-system API calls and their return values.","collection_focus":"Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["process_id","api","path","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."}],"detection":{"key":"ics/T0834","id":"T0834","name":"Native API","domain":"ics","platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T0834","technique_page":"techniques/ics/T0834/","page":"detections/ics/T0834/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0753","name":"Detection of Native API","url":"https://attack.mitre.org/detectionstrategies/DET0753","stix_id":"x-mitre-detection-strategy--5ba60cf7-738d-4ed4-827c-8c763ad9f0f0","relationship_id":"relationship--c297179c-66a5-41b4-9a12-59f7480bc25e","description":"","analytics":[{"id":"AN1885","name":"Analytic 1885","guidance":"Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host making direct native Operating System (OS) Application Programming Interface (API) calls that bypass the normal ICS vendor Software Development Kit (SDK) abstraction layer -- direct CreateFile calls against raw device paths, DeviceIoControl calls to ICS hardware driver handles -- from a process not a recognized vendor application. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0753#AN1885","platforms":["Windows"],"tuning":[{"field":"AuthorizedICSApplications","description":"Allowlist of processes expected to interact with ICS hardware/protocols."}],"log_sources":[{"component_id":"DC0021","component":"OS API Execution","name":"edr:Syscall","channel":"DeviceIoControl or raw socket creation to Industrial Control Systems (ICS) protocol port from process not in authorized ICS applications, bypassing documented vendor Software Development Kit (SDK) call pattern","platforms":["Windows"],"analytic_id":"AN1885","source_url":"https://attack.mitre.org/detectionstrategies/DET0753#AN1885","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"}]},{"id":"AN2138","name":"Analytic 2138","guidance":"Real-time monitoring identifies a process making direct ioctl or mmap syscalls against Industrial Control System (ICS) hardware device files, bypassing the vendor's documented Application Programming Interface (API) layer, from a process not in the recognized ICS application list. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0753#AN2138","platforms":["Linux"],"tuning":[{"field":"AuthorizedICSApplications","description":"Allowlist of processes expected to interact with ICS hardware/protocols."}],"log_sources":[{"component_id":"DC0021","component":"OS API Execution","name":"auditd:SYSCALL","channel":"Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): ioctl or mmap syscall against Industrial Control Systems (ICS) hardware device file from process not in authorized ICS applications","platforms":["Linux"],"analytic_id":"AN2138","source_url":"https://attack.mitre.org/detectionstrategies/DET0753#AN2138","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0021/"}]},{"id":"AN2183","name":"Analytic 2183","guidance":"Use an OT-capable protocol decoder to monitor SNMP requests/responses and identify access to vendor-internal or undocumented OIDs from sources outside the approved NMS inventory, especially SET operations or unusual walks against control-network infrastructure. This is network-protocol observation, not OS API execution; require decoded SNMP transaction content or equivalent packet inspection.","url":"https://attack.mitre.org/detectionstrategies/DET0753#AN2183","platforms":["Network Devices"],"tuning":[{"field":"AuthorizedICSApplications","description":"Allowlist of processes expected to interact with ICS hardware/protocols."}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"otids:ProtocolDecoder","channel":"SNMP request/response decoder: OID, operation type, source/destination; flag access to undocumented/vendor-internal OIDs from non-approved NMS sources","platforms":["Network Devices"],"analytic_id":"AN2183","source_url":"https://attack.mitre.org/detectionstrategies/DET0753#AN2183","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN2246","name":"Analytic 2246","guidance":"Real-time monitoring identifies Industrial Control System (ICS) protocol messages using vendor-specific or undocumented function codes that access device hardware registers directly rather than through the normal ICS application layer, from a source not in the approved engineering workstation list. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0753#AN2246","platforms":["Embedded"],"tuning":[{"field":"AuthorizedICSApplications","description":"Allowlist of processes expected to interact with ICS hardware/protocols."}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Content","channel":"reserved or vendor-specific function code accessing device registers directly from source not in engineering workstation list","platforms":["Embedded"],"analytic_id":"AN2246","source_url":"https://attack.mitre.org/detectionstrategies/DET0753#AN2246","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0021","name":"OS API Execution","tag":"OS API Execution","page":"telemetry/DC0021/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) calls system function blocks which are part of the operating system running on the PLC. Theyre used to execute system tasks, such as reading the system clock (SFC1) and generating data blocks on the fly. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--3d005ed8-77d3-4fed-9dd5-7e39ba8cb50a","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S1006","name":"PLC-Blaster","url":"https://attack.mitre.org/software/S1006","kind":"malware","description":"[PLC-Blaster](https://attack.mitre.org/software/S1006) uses the system function blocks TCON and TDISCON to initiate and destroy TCP connections to arbitrary systems. Buffers may be sent and received on these connections with TRCV und TSEND system function blocks. (Citation: Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016)","relationship_id":"relationship--21041206-da58-45c7-adb0-db07caebdcb6","references":[{"source_name":"Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016","description":"Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke 2016, March 31 Plc-blaster: A worm living solely in the plc. Retrieved. 2017/09/19 ","url":"https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf"}]},{"id":"S1009","name":"Triton","url":"https://attack.mitre.org/software/S1009","kind":"malware","description":"[Triton](https://attack.mitre.org/software/S1009)'s imain.bin payload takes commands from the TsHi.ExplReadRam(Ex), TsHi.ExplWriteRam(Ex) and TsHi.ExplExec functions to perform operations on controller memory and registers using syscalls written in PowerPC shellcode. (Citation: Jos Wetzels January 2018)","relationship_id":"relationship--13809e98-1d74-4c39-b882-9d523c76cbde","references":[{"source_name":"Jos Wetzels January 2018","description":"Jos Wetzels 2018, January 16 Analyzing the TRITON industrial malware Retrieved. 2019/10/22 ","url":"https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware"}]}],"actors":[],"mitigations":[{"id":"M0938","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M0938","kind":"course-of-action","description":"Minimize the exposure of API calls that allow the execution of code.\n","relationship_id":"relationship--446c95ea-5178-4ae9-8f92-cb20dd50f7de","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0834":"/ttp-simulation/techniques/ics/T0834/","T1106":"/ttp-simulation/techniques/enterprise/T1106/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0834","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0021","collector":"illustrative-lab-collector","observation":{"process_id":4200,"api":"CreateFileW","path":"C:\\Lab\\demo.txt","result":"success"}}]}}