T1106 Native API — Detection Rules

Source-backed rule directory

• BPFDoor Abnormal Process ID or Lock File Accessed · test · high · {"product":"linux","service":"auditd"}
• HackTool - WinPwn Execution - ScriptBlock · test · high · {"category":"ps_script","product":"windows","definition":"Requirements: Script Block Logging must be enabled"}
• Potential WinAPI Calls Via PowerShell Scripts · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• HackTool - CobaltStrike BOF Injection Pattern · test · high · {"category":"process_access","product":"windows"}
• HackTool - HandleKatz Duplicating LSASS Handle · test · high · {"category":"process_access","product":"windows"}
• Potential Direct Syscall of NtOpenProcess · test · medium · {"category":"process_access","product":"windows"}
• Potential Binary Proxy Execution Via Cdb.EXE · test · medium · {"category":"process_creation","product":"windows"}
• HackTool - RedMimicry Winnti Playbook Execution · test · high · {"product":"windows","category":"process_creation"}
• HackTool - WinPwn Execution · test · high · {"category":"process_creation","product":"windows"}
• Suspicious Mshta.EXE Execution Patterns · test · high · {"category":"process_creation","product":"windows"}
• Potential WinAPI Calls Via CommandLine · test · high · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0529 Behavioral Detection of Native API Invocation via Unusual DLL Loads and Direct Syscalls

AN1465 Analytic 1465

Unusual or suspicious processes loading critical native API DLLs (e.g., ntdll.dll, kernel32.dll) followed by direct syscall behavior, memory manipulation, or hollowing.

AN1466 Analytic 1466

Userland processes invoking syscall-heavy libraries (libc, glibc) followed by fork, mmap, or ptrace behavior commonly associated with code injection or memory manipulation.

AN1467 Analytic 1467

Execution of processes that link to CoreServices or Foundation APIs followed by creation of memory regions, code execution, or abnormal library injection.