T0871 Execution through API — Detection Rules

Source-backed rule directory

No reviewed association in this snapshot.

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0742 Detection of Execution through API

AN1875 Analytic 1875

Real-time monitoring identifies an unrecognized process on an ICS Linux host loading an ICS/vendor shared library that is normally restricted to approved control or engineering applications. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

AN2208 Analytic 2208

Monitor OPC UA server audit events for state-changing Write or Method service invocations and compare ClientUserId, ClientApplicationUri, SourceNode/MethodId, status, and arguments with the approved client/method baseline. For servers that support auditing, AuditWriteUpdateEventType and AuditUpdateMethodEventType provide an analyst-visible record of writes and state-changing method calls. Alert on successful or attempted control operations from unapproved clients/users or against methods/nodes outside the documented engineering workflow; do not describe this as Windows OS API telemetry.

AN2239 Analytic 2239

Real-time monitoring identifies Open Platform Communications (OPC) Unified Architecture (UA) method invocations or International Electrotechnical Commission (IEC) 61850 Abstract Common Services Interface (ACSI) service requests arriving at a field device from a client identity not in the approved application allowlist, where the invoked method is a write or control operation rather than read/subscribe. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

AN2289 Analytic 2289

Real-time monitoring identifies network traffic to Industrial Control System (ICS) Application Programming Interface (API) ports such as 4840 used in the Open Platform Communications (OPC) Unified Architecture (UA) or vendor-specific API ports from source Internet Protocol (IP) addresses not in the approved application client list, where the traffic pattern is consistent with write/control method invocations rather than subscription/read traffic. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.