Native API
Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.[1][2] These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Functionality provided by native APIs are often also exposed to user-mode applications via interfaces and libraries. For example, functions such as the Windows API CreateProcess()
or GNU fork()
will allow programs and scripts to start other processes.[3][4] This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.[5][6][7]
Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.[8][9][10][11]
Adversaries may abuse these native API functions as a means of executing behaviors. Similar to Command and Scripting Interpreter, the native API and its hierarchy of interfaces, provide mechanisms to interact with and utilize various components of a victimized system.
Procedure Examples
Name | Description |
---|---|
ADVSTORESHELL |
ADVSTORESHELL is capable of starting a process using CreateProcess.[12] |
APT37 |
APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.[13] |
Aria-body |
Aria-body has the ability to launch files using |
Attor |
Attor's dispatcher has used CreateProcessW API for execution.[15] |
BackConfig |
BackConfig can leverage API functions such as |
BADNEWS |
BADNEWS has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute.[17][18] |
Bankshot |
Bankshot creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA().[19] |
BBK |
BBK has the ability to use the |
BloodHound |
BloodHound can use .NET API calls in the SharpHound ingestor component to pull Active Directory data.[21] |
build_downer |
build_downer has the ability to use the |
Carberp |
Carberp has used the NtQueryDirectoryFile and ZwQueryDirectoryFile functions to hide files and directories.[22] |
Chimera |
Chimera has used direct Windows system calls by leveraging Dumpert.[23] |
Cobalt Strike |
Cobalt Strike's "beacon" payload is capable of running shell commands without |
ComRAT |
ComRAT can load a PE file from memory or the file system and execute it with |
Denis |
Denis used the |
Empire |
Empire contains a variety of enumeration modules that have an option to use API calls to carry out tasks.[27] |
FatDuke |
FatDuke can call |
Gamaredon Group |
Gamaredon Group malware has used |
gh0st RAT |
gh0st RAT has used the InterlockedExchange, SeShutdownPrivilege, and ExitWindowsEx Windows API functions.[30] |
GoldenSpy |
GoldenSpy can execute remote commands in the Windows command shell using the |
Goopy |
Goopy has the ability to enumerate the infected system's user name via |
Gorgon Group |
Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution.[32] |
Hancitor |
Hancitor has used |
HAWKBALL |
HAWKBALL has leveraged several Windows API calls to create processes, gather disk information, and detect debugger activity.[34] |
HotCroissant |
HotCroissant can perform dynamic DLL importing and API lookups using |
HyperBro |
HyperBro has the ability to run an application ( |
IcedID |
IcedID has called |
Imminent Monitor |
Imminent Monitor has leveraged CreateProcessW() call to execute the debugger.[38] |
InnaputRAT |
InnaputRAT uses the API call ShellExecuteW for execution.[39] |
InvisiMole |
InvisiMole can use winapiexec tool for indirect execution of |
LightNeuron |
LightNeuron is capable of starting a process using CreateProcess.[41] |
Maze |
Maze has used several Windows API functions throughout the encryption process including IsDebuggerPresent, TerminateProcess, Process32FirstW, among others.[42] |
Metamorfo | |
Mosquito |
Mosquito leverages the CreateProcess() and LoadLibrary() calls to execute files with the .dll and .exe extensions.[45] |
Netwalker |
Netwalker can use Windows API functions to inject the ransomware DLL.[46] |
njRAT |
njRAT has used the ShellExecute() function within a script.[47] |
Pillowmint |
Pillowmint has used multiple native Windows APIs to execute and conduct process injections.[48] |
PipeMon |
PipeMon's first stage has been executed by a call to |
PlugX |
PlugX can use the Windows API function CreateProcess to execute another process.[50] |
PolyglotDuke |
PolyglotDuke can use |
Pony |
Pony has used several Windows functions for various purposes.[51] |
Ramsay |
Ramsay can use the Windows COM API to schedule tasks and maintain persistence as well as the |
RDFSNIFFER |
RDFSNIFFER has used several Win32 API functions to interact with the victim machine.[53] |
REvil |
REvil can use Native API for execution and to retrieve active services.[54][55] |
Rising Sun |
Rising Sun used dynamic API resolutions to various Windows APIs by leveraging LoadLibrary() and GetProcAddress().[56] |
RTM |
RTM can use the |
Ryuk |
Ryuk has used multiple native APIs including |
Sharpshooter |
Sharpshooter's first-stage downloader resolved various Windows libraries and APIs, including LoadLibraryA(), GetProcAddress(), and CreateProcessA().[56] |
ShimRat |
ShimRat has used Windows API functions to install the service and shim.[59] |
ShimRatReporter |
ShimRatReporter used several Windows API functions to gather information from the infected system.[59] |
Silence |
Silence has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.[60][61] |
Sunspot |
Sunspot used Windows API functions such as |
SynAck |
SynAck parses the export tables of system DLLs to locate and call various Windows API functions.[63][64] |
TrickBot |
TrickBot uses the Windows API call, CreateProcessW(), to manage execution flow.[65] |
Tropic Trooper |
Tropic Trooper has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.[66] |
Turla |
Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.[67] |
Ursnif |
Ursnif has used |
Volgmer |
Volgmer executes payloads using the Windows API call CreateProcessW().[69] |
WindTail |
WindTail can invoke Apple APIs |
XAgentOSX |
XAgentOSX contains the execFile function to execute a specified file on the system using the NSTask:launch method.[71] |
Mitigations
Mitigation | Description |
---|---|
Execution Prevention |
Identify and block potentially malicious software executed that may be executed through this technique by using application control [72] tools, like Windows Defender Application Control[73], AppLocker, [74] [75] or Software Restriction Policies [76] where appropriate. [77] |
Detection
Monitoring API calls may generate a significant amount of data and may not be useful for defense unless collected under specific circumstances, since benign use of API functions are common and difficult to distinguish from malicious behavior. Correlation of other events with behavior surrounding API function calls using API monitoring will provide additional context to an event that may assist in determining if it is due to malicious behavior. Correlation of activity by process lineage by process ID may be sufficient.
Utilization of the Windows API may involve processes loading/accessing system DLLs associated with providing called functions (ex: kernel32.dll, advapi32.dll, user32.dll, and gdi32.dll). Monitoring for DLL loads, especially to abnormal/unusual or potentially malicious processes, may indicate abuse of the Windows API. Though noisy, this data can be combined with other indicators to identify adversary activity.
References
- The NTinterlnals.net team. (n.d.). Nowak, T. Retrieved June 25, 2020.
- Linux Kernel Organization, Inc. (n.d.). The Linux Kernel API. Retrieved June 25, 2020.
- Microsoft. (n.d.). CreateProcess function. Retrieved December 5, 2014.
- Free Software Foundation, Inc.. (2020, June 18). Creating a Process. Retrieved June 25, 2020.
- Microsoft. (n.d.). Programming reference for the Win32 API. Retrieved March 15, 2020.
- Kerrisk, M. (2016, December 12). libc(7) — Linux manual page. Retrieved June 25, 2020.
- glibc developer community. (2020, February 1). The GNU C Library (glibc). Retrieved June 25, 2020.
- Microsoft. (n.d.). What is .NET Framework?. Retrieved March 15, 2020.
- Apple. (n.d.). Core Services. Retrieved June 25, 2020.
- Apple. (2015, September 16). Cocoa Application Layer. Retrieved June 25, 2020.
- Apple. (n.d.). Foundation. Retrieved July 1, 2020.
- Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017.
- Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.
- CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.
- Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.
- Hinchliffe, A. and Falcone, R. (2020, May 11). Updated BackConfig Malware Targeting Government and Military Organizations in South Asia. Retrieved June 17, 2020.
- Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.
- Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
- Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.
- Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
- Robbins, A., Vazarkar, R., and Schroeder, W. (2016, April 17). Bloodhound: Six Degrees of Domain Admin. Retrieved March 5, 2019.
- Trusteer Fraud Prevention Center. (2010, October 7). Carberp Under the Hood of Carberp: Malware & Configuration Analysis. Retrieved July 15, 2020.
- Cycraft. (2020, April 15). APT Group Chimera - APT Operation Skeleton key Targets Taiwan Semiconductor Vendors. Retrieved August 24, 2020.
- Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.
- Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.
- Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
- Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.
- Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
- Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.
- Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020.
- Trustwave SpiderLabs. (2020, June 25). The Golden Tax Department and Emergence of GoldenSpy Malware. Retrieved July 23, 2020.
- Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.
- Anubhav, A., Jallepalli, D. (2016, September 23). Hancitor (AKA Chanitor) observed using multiple attack approaches. Retrieved August 13, 2020.
- Patil, S. and Williams, M.. (2019, June 5). Government Sector in Central Asia Targeted With New HAWKBALL Backdoor Delivered via Microsoft Office Vulnerabilities. Retrieved June 20, 2019.
- US-CERT. (2020, February 20). MAR-10271944-1.v1 – North Korean Trojan: HOTCROISSANT. Retrieved May 1, 2020.
- Falcone, R. and Lancaster, T.. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019.
- Kimayong, P. (2020, June 18). COVID-19 and FMLA Campaigns used to install new IcedID banking malware. Retrieved July 14, 2020.
- QiAnXin Threat Intelligence Center. (2019, February 18). APT-C-36: Continuous Attacks Targeting Colombian Government Institutions and Corporations. Retrieved May 5, 2020.
- ASERT Team. (2018, April 04). Innaput Actors Utilize Remote Access Trojan Since 2016, Presumably Targeting Victim Files. Retrieved July 9, 2018.
- Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
- Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019.
- Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.
- Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.
- Zhang, X.. (2020, February 4). Another Metamorfo Variant Targeting Customers of Financial Institutions in More Countries. Retrieved July 30, 2020.
- ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.
- Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.
- Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.
- Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.
- Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.
- Vasilenko, R. (2013, December 17). An Analysis of PlugX Malware. Retrieved November 24, 2015.
- hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.
- Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.
- Carr, N, et all. (2019, October 10). Mahalo FIN7: Responding to the Criminal Operators’ New Tools and Techniques. Retrieved October 11, 2019.
- Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.
- Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.
- Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.
- Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
- Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.
- Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.
- GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.
- Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.
- CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021.
- Ivanov, A. et al.. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
- Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
- Salinas, M., Holguin, J. (2017, June). Evolution of Trickbot. Retrieved July 31, 2018.
- Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
- Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.
- Vaish, A. & Nemes, S. (2017, November 28). Newly Observed Ursnif Variant Employs Malicious TLS Callback Technique to Achieve Process Injection. Retrieved June 5, 2019.
- US-CERT. (2017, November 01). Malware Analysis Report (MAR) - 10135536-D. Retrieved July 16, 2018.
- Wardle, Patrick. (2019, January 15). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 2). Retrieved October 3, 2019.
- Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.
- Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.
- Gorzelany, A., Hall, J., Poggemeyer, L.. (2019, January 7). Windows Defender Application Control. Retrieved July 16, 2019.
- Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.
- NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016.
- Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014.
- Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.