Home/ MITRE Matrix/ Execution/ T1106

T1106Native API

T1106 — Native API is a MITRE ATT&CK technique in the Execution tactic. Clankerusecase tracks 2 detection use cases covering it and 4 threat-intel articles citing it.

Execution

View on the matrix → Filter Detection Library MITRE official spec ↗

2Use cases

4Articles

0Sub-techniques

1Tactic

Use cases covering this technique (2)

[LLM] Four-way node.exe -e fanout spawned from VSCode shell descendants (BlokTrooper stage-2) Bespoke install · alerting DSPDDCS [LLM] DaemonicLogistics fake-Tencent payload drop (logo.gif at %PROGRAMDATA%\Tencent\QQUpdateMgr\UpdateFiles) Bespoke install · alerting DSΣP

Articles citing this technique (4)

crit ESET takes part in Operation Endgame to disrupt Amadey and Stealc art-301

crit fast-draft Open VSX Extension Compromised by BlokTrooper art-581

crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-728

crit PlushDaemon compromises network devices for adversary-in-the-middle attacks art-773