Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0529 — Behavioral Detection of Native API Invocation via Unusual DLL Loads and Direct Syscalls
DET0529

Behavioral Detection of Native API Invocation via Unusual DLL Loads and Direct Syscalls

3 analytic(s) · 1 technique(s) detected

Analytics

3
AN1465 Analytic 1465
Windows

Unusual or suspicious processes loading critical native API DLLs (e.g., ntdll.dll, kernel32.dll) followed by direct syscall behavior, memory manipulation, or hollowing.

WinEventLog:Sysmon EventCode=7 WinEventLog:Sysmon EventCode=10 WinEventLog:Sysmon EventCode=1
[DllName] May tune DLL filters to focus on low-level API providers (e.g., ntdll.dll)
[Image] Tune for expected parent processes (e.g., explorer.exe, winlogon.exe)
[TargetProcess] Scope to suspicious targets like LSASS, csrss, etc.
AN1466 Analytic 1466
Linux

Userland processes invoking syscall-heavy libraries (libc, glibc) followed by fork, mmap, or ptrace behavior commonly associated with code injection or memory manipulation.

auditd:SYSCALL execve, fork, mmap, ptrace auditd:SYSCALL module load or memory map path
[SyscallType] Filter for fork, mmap, ptrace based on context
[ProcessName] Whitelist known daemon and scheduled task patterns
[MAPS Path] Tune suspicious memory map regions (e.g., /tmp/.evilshmem)
AN1467 Analytic 1467
macOS

Execution of processes that link to CoreServices or Foundation APIs followed by creation of memory regions, code execution, or abnormal library injection.

macos:unifiedlog launch and dylib load macos:endpointsecurity ES_EVENT_TYPE_NOTIFY_EXEC
[API Framework Name] Filter on CoreServices, Cocoa, Foundation framework usage
[Execution Context] Tune to exclude known developer tools or test environments

Detected Techniques

1

Execution (1)

Details

MITRE ID
DET0529
STIX ID
x-mitre-detection-strategy--36654ec6-5019-4e79-b299-1fbf3a03e064
Analytics
3
Techniques Detected
1
By Tactic
Execution
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.