Trusted Design
Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Adversaries may abuse these OS API functions as a means of executing behaviors. Similar to Command and Scripting Interpreter, the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system.
Native API functions (such as NtCreateProcess) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.(Citation: OutFlank System Calls)(Citation: CyberBit System Calls)(Citation: MDSec System Calls) For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)
Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation)
Adversaries may use assembly to directly or in-directly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks.(Citation: Redops Syscalls) Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via Disable or Modify Tools.
T1106「Native API」 は、攻撃者がOSの深層部分である 「ネイティブAPI」 を直接呼び出して、悪意のある活動を実行する手法です。
通常、プログラムはOSが用意した「標準的な窓口（高レベルな関数）」を通じますが、攻撃者はそれをバイパスして、OSの「心臓部（低レベルな関数）」に直接命令を下します。
この手法で攻撃者は、「セキュリティ製品の監視をすり抜けた、よりステルス性の高い操作」を実現します。
攻撃者は、マルウェア（C++やC#などで作成）の中から直接OSの関数を呼び出します。
ntdll.dll や kernel32.dll などのシステムライブラリをプログラム内に読み込みます。CreateProcess）ではなく、その裏で動くネイティブな関数（例：NtCreateProcess）を指定します。NtAllocateVirtualMemory でメモリを確保。NtWriteVirtualMemory でマルウェア本体を書き込む。NtCreateThreadEx で書き込んだコードを実行させる。APIの呼び出し自体は正規の挙動であるため、その「不自然な組み合わせ」を見抜く必要があります。
Nt シリーズなど）を直接監視・記録できる高度なEDR（Endpoint Detection and Response）を導入します。もし開発やセキュリティ分析を行っているなら、Windowsの ntdll.dll に含まれる Nt... や Zw... で始まる関数がマルウェアの中でどのように使われているかを調べると、この手法の真髄が理解できます。
この攻撃手法に関連する CVE は登録されていません。