MITRE ATT&CK technique
Native API detection rulesT1106
Native API (T1106) is a MITRE ATT&CK technique in the Execution tactic. This page lists the 14 community-maintained Sigma detection rules in the library mapped to T1106 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows, linux.
Turla Group Named Pipes
criticalDetects a named pipe used by Turla group samples
windows · pipe_created
BPFDoor Abnormal Process ID or Lock File Accessed
highdetects BPFDoor .lock and .pid files access in temporary file storage facility
linux
HackTool - CobaltStrike BOF Injection Pattern
highDetects a typical pattern of a CobaltStrike BOF which inject into other processes
windows · process_access
HackTool - HandleKatz Duplicating LSASS Handle
highDetects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles
windows · process_access
HackTool - RedMimicry Winnti Playbook Execution
highDetects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility
windows · process_creation
HackTool - WinPwn Execution
highDetects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
windows · process_creation
HackTool - WinPwn Execution - ScriptBlock
highDetects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
windows · ps_script
Potential WinAPI Calls Via CommandLine
highDetects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec
windows · process_creation
Potential WinAPI Calls Via PowerShell Scripts
highDetects usage of WinAPI functions in PowerShell scripts. It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls. These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.
windows · ps_script
Suspicious Mshta.EXE Execution Patterns
highDetects suspicious mshta process execution patterns
windows · process_creation
Potential Binary Proxy Execution Via Cdb.EXE
mediumDetects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file
windows · process_creation
Potential Direct Syscall of NtOpenProcess
mediumDetects potential calls to NtOpenProcess directly from NTDLL.
windows · process_access
WinAPI Function Calls Via PowerShell Scripts
mediumDetects calls to WinAPI functions from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.
windows · ps_script
WinAPI Library Calls Via PowerShell Scripts
mediumDetects calls to WinAPI libraries from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.
windows · ps_script