1. Home
  2. Techniques
  3. Enterprise
  4. Native API

Native API

Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.[1][2] These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.

Native API functions (such as NtCreateProcess) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries. [3][4][5] For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.[6][7] This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.[8][9][10]

Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.[11][12][13][14]

Adversaries may abuse these OS API functions as a means of executing behaviors. Similar to Command and Scripting Interpreter, the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system. While invoking API functions, adversaries may also attempt to bypass defensive tools (ex: unhooking monitored functions via Disable or Modify Tools).

ID: T1106
Sub-techniques:  No sub-techniques
ⓘ
Tactic: Execution
ⓘ
Platforms: Linux, Windows, macOS
ⓘ
Permissions Required: User
Contributors: Gordon Long, Box, Inc., @ethicalhax; Stefan Kanthak
Version: 2.1
Created: 31 May 2017
Last Modified: 18 October 2021
Provided by LAYER 8

Procedure Examples

ID Name Description
S0045 ADVSTORESHELL

ADVSTORESHELL is capable of starting a process using CreateProcess.[15]
S0622 AppleSeed

AppleSeed has the ability to use multiple dynamically resolved API calls.[16]
G0067 APT37

APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.[17]
G0082 APT38

APT38 has used the Windows API to execute code within a victim's system.[18]

S0456 Aria-body

Aria-body has the ability to launch files using ShellExecute.[19]
S0438 Attor

Attor's dispatcher has used CreateProcessW API for execution.[20]
S0640 Avaddon

Avaddon has used the Windows Crypto API to generate an AES key.[21]
S0638 Babuk

Babuk can use multiple Windows API calls for actions on compromised hosts including discovery and execution.[22][23][24]
S0475 BackConfig

BackConfig can leverage API functions such as ShellExecuteA and HttpOpenRequestA in the process of downloading and executing files.[25]
S0606 Bad Rabbit

Bad Rabbit has used various Windows API calls.[26]
S0128 BADNEWS

BADNEWS has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute.[27][28]
S0234 Bandook

Bandook has used the ShellExecuteW() function call.[29]

S0239 Bankshot

Bankshot creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA().[30]
S0534 Bazar

Bazar can use various APIs to allocate memory and facilitate code execution/injection.[31]
S0470 BBK

BBK has the ability to use the CreatePipe API to add a sub-process for execution via cmd.[32]
S0574 BendyBear

BendyBear can load and execute modules and Windows Application Programming (API) calls using standard shellcode API hashing.[33]
S0570 BitPaymer

BitPaymer has used dynamic API resolution to avoid identifiable strings within the binary, including RegEnumKeyW.[34]
S0521 BloodHound

BloodHound can use .NET API calls in the SharpHound ingestor component to pull Active Directory data.[35]
S0651 BoxCaon

BoxCaon has used Windows API calls to obtain information about the compromised host.[36]
S0471 build_downer

build_downer has the ability to use the WinExec API to execute malware on a compromised host.[32]
S0484 Carberp

Carberp has used the NtQueryDirectoryFile and ZwQueryDirectoryFile functions to hide files and directories.[37]
S0631 Chaes

Chaes used the CreateFileW() API function with read permissions to access downloaded payloads.[38]

G0114 Chimera

Chimera has used direct Windows system calls by leveraging Dumpert.[39]
S0611 Clop

Clop has used built-in API functions such as WNetOpenEnumW(), WNetEnumResourceW(), WNetCloseEnum(), GetProcAddress(), and VirtualAlloc().[40][41]
S0154 Cobalt Strike

Cobalt Strike's Beacon payload is capable of running shell commands without cmd.exe and PowerShell commands without powershell.exe[42][43][44]
S0126 ComRAT

ComRAT can load a PE file from memory or the file system and execute it with CreateProcessW.[45]
S0575 Conti

Conti has used API calls during execution.[46][47]

S0625 Cuba

Cuba has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum.[48]

S0354 Denis

Denis used the IsDebuggerPresent, OutputDebugString, and SetLastError APIs to avoid debugging. Denis used GetProcAddress and LoadLibrary to dynamically resolve APIs. Denis also used the Wow64SetThreadContext API as part of a process hollowing process.[49]

S0384 Dridex

Dridex has used the OutputDebugStringW function to avoid malware analysis as part of its anti-debugging technique.[50]

S0554 Egregor

Egregor has used the Windows API to make detection more difficult.[51]

S0363 Empire

Empire contains a variety of enumeration modules that have an option to use API calls to carry out tasks.[52]
S0396 EvilBunny

EvilBunny has used various API calls as part of its checks to see if the malware is running in a sandbox.[53]

S0569 Explosive

Explosive has a function to call the OpenClipboard wrapper.[54]

S0512 FatDuke

FatDuke can call ShellExecuteW to open the default browser on the URL localhost.[55]
G0047 Gamaredon Group

Gamaredon Group malware has used CreateProcess to launch additional malicious components.[56]
S0032 gh0st RAT

gh0st RAT has used the InterlockedExchange, SeShutdownPrivilege, and ExitWindowsEx Windows API functions.[57]
S0493 GoldenSpy

GoldenSpy can execute remote commands in the Windows command shell using the WinExec() API.[58]

S0477 Goopy

Goopy has the ability to enumerate the infected system's user name via GetUserNameW.[49]
G0078 Gorgon Group

Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution.[59]
S0531 Grandoreiro

Grandoreiro can execute through the WinExec API.[60]
S0632 GrimAgent

GrimAgent can use Native API including GetProcAddress and ShellExecuteW.[61]
S0561 GuLoader

GuLoader can use a number of different APIs for discovery and execution.[62]
S0499 Hancitor

Hancitor has used CallWindowProc and EnumResourceTypesA to interpret and execute shellcode.[63]
S0391 HAWKBALL

HAWKBALL has leveraged several Windows API calls to create processes, gather disk information, and detect debugger activity.[64]
G0126 Higaisa

Higaisa has called various native OS APIs.[65]
S0431 HotCroissant

HotCroissant can perform dynamic DLL importing and API lookups using LoadLibrary and GetProcAddress on obfuscated strings.[66]
S0398 HyperBro

HyperBro has the ability to run an application (CreateProcessW) or script/file (ShellExecuteW) via API.[67]
S0537 HyperStack

HyperStack can use Windows API's ConnectNamedPipe and WNetAddConnection2 to detect incoming connections and connect to remote shares.[68]
S0483 IcedID

IcedID has called ZwWriteVirtualMemory, ZwProtectVirtualMemory, ZwQueueApcThread, and NtResumeThread to inject itself into a remote process.[69]
S0434 Imminent Monitor

Imminent Monitor has leveraged CreateProcessW() call to execute the debugger.[70]
S0259 InnaputRAT

InnaputRAT uses the API call ShellExecuteW for execution.[71]
S0260 InvisiMole

InvisiMole can use winapiexec tool for indirect execution of ShellExecuteW and CreateProcessA.[72]
S0607 KillDisk

KillDisk has called the Windows API to retrieve the hard disk handle and shut down the machine.[73]
S0395 LightNeuron

LightNeuron is capable of starting a process using CreateProcess.[74]
S0447 Lokibot

Lokibot has used LoadLibrary(), GetProcAddress() and CreateRemoteThread() API functions to execute its shellcode.[75]
S0652 MarkiRAT

MarkiRAT can run the ShellExecuteW API via the Windows Command Shell.[76]
S0449 Maze

Maze has used several Windows API functions throughout the encryption process including IsDebuggerPresent, TerminateProcess, Process32FirstW, among others.[77]

S0576 MegaCortex

After escalating privileges, MegaCortex calls TerminateProcess(), CreateRemoteThread, and other Win32 APIs.[78]
G0045 menuPass

menuPass has used native APIs including GetModuleFileName, lstrcat, CreateFile, and ReadFile.[79]
S0455 Metamorfo

Metamorfo has used native WINAPI calls.[80][81]
S0256 Mosquito

Mosquito leverages the CreateProcess() and LoadLibrary() calls to execute files with the .dll and .exe extensions.[82]
S0630 Nebulae

Nebulae has the ability to use CreateProcess to execute a process.[83]
S0457 Netwalker

Netwalker can use Windows API functions to inject the ransomware DLL.[84]
S0198 NETWIRE

NETWIRE can use Native API including CreateProcess GetProcessById, and WriteProcessMemory.[85]
S0385 njRAT

njRAT has used the ShellExecute() function within a script.[86]
G0116 Operation Wocao

Operation Wocao has used the CreateProcessA and ShellExecute API function to launch commands after being injected into a selected process.[87]
S0517 Pillowmint

Pillowmint has used multiple native Windows APIs to execute and conduct process injections.[88]
S0501 PipeMon

PipeMon's first stage has been executed by a call to CreateProcess with the decryption password in an argument. PipeMon has used a call to LoadLibrary to load its installer.[89]
S0013 PlugX

PlugX can use the Windows API function CreateProcess to execute another process.[90]
S0518 PolyglotDuke

PolyglotDuke can use LoadLibraryW and CreateProcess to load and execute code.[55]
S0453 Pony

Pony has used several Windows functions for various purposes.[91]

S0650 QakBot

QakBot can use GetProcAddress to help delete malicious strings from memory.[92]
S0629 RainyDay

The file collection tool used by RainyDay can utilize native API including ReadDirectoryChangeW for folder monitoring.[83]
S0458 Ramsay

Ramsay can use Windows API functions such as WriteFile, CloseHandle, and GetCurrentHwProfile during its collection and file storage operations. Ramsay can execute its embedded components via CreateProcessA and ShellExecute.[93]
S0416 RDFSNIFFER

RDFSNIFFER has used several Win32 API functions to interact with the victim machine.[94]
S0496 REvil

REvil can use Native API for execution and to retrieve active services.[95][96]
S0448 Rising Sun

Rising Sun used dynamic API resolutions to various Windows APIs by leveraging LoadLibrary() and GetProcAddress().[97]
S0148 RTM

RTM can use the FindNextUrlCacheEntryA and FindFirstUrlCacheEntryA functions to search for specific strings within browser history.[98]
S0446 Ryuk

Ryuk has used multiple native APIs including ShellExecuteW to run executables,GetWindowsDirectoryW to create folders, and VirtualAlloc, WriteProcessMemory, and CreateRemoteThread for process injection.[99]
G0104 Sharpshooter

Sharpshooter's first-stage downloader resolved various Windows libraries and APIs, including LoadLibraryA(), GetProcAddress(), and CreateProcessA().[97]

S0444 ShimRat

ShimRat has used Windows API functions to install the service and shim.[100]

S0445 ShimRatReporter

ShimRatReporter used several Windows API functions to gather information from the infected system.[100]
S0610 SideTwist

SideTwist can use GetUserNameW, GetComputerNameW, and GetComputerNameExW to gather information.[101]
G0091 Silence

Silence has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.[102][103]
S0623 Siloscape

Siloscape makes various native API calls.[104]
S0627 SodaMaster

SodaMaster can use RegOpenKeyW to access the Registry.[105]
S0615 SombRAT

SombRAT has the ability to respawn itself using ShellExecuteW and CreateProcessW.[106]
S0603 Stuxnet

Stuxnet uses the SetSecurityDescriptorDacl API to reduce object integrity levels.[107]
S0562 SUNSPOT

SUNSPOT used Windows API functions such as MoveFileEx and NtQueryInformationProcess as part of the SUNBURST injection process.[108]

S0242 SynAck

SynAck parses the export tables of system DLLs to locate and call various Windows API functions.[109][110]
S0011 Taidoor

Taidoor has the ability to use native APIs for execution including GetProcessHeap, GetProcAddress, and LoadLibrary.[111][112]
S0595 ThiefQuest

ThiefQuest uses various API to perform behaviors such as executing payloads and performing local enumeration.[113]
S0266 TrickBot

TrickBot uses the Windows API call, CreateProcessW(), to manage execution flow.[114] TrickBot has also used Nt* API functions to perform Process Injection.[115]
G0081 Tropic Trooper

Tropic Trooper has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.[116]
G0010 Turla

Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.[117]
S0386 Ursnif

Ursnif has used CreateProcessW to create child processes.[118]
S0180 Volgmer

Volgmer executes payloads using the Windows API call CreateProcessW().[119]
S0612 WastedLocker

WastedLocker's custom crypter, CryptOne, leveraged the VirtualAlloc() API function to help execute the payload.[120]
S0579 Waterbear

Waterbear can leverage API functions for execution.[121]
S0466 WindTail

WindTail can invoke Apple APIs contentsOfDirectoryAtPath, pathExtension, and (string) compare.[122]
S0161 XAgentOSX

XAgentOSX contains the execFile function to execute a specified file on the system using the NSTask:launch method.[123]
S0653 xCaon

xCaon has leveraged native OS function calls to retrieve victim's network adapter's information using GetAdapterInfo() API.[36]

Mitigations

ID Mitigation Description
M1040 Behavior Prevention on Endpoint

On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office VBA macros from calling Win32 APIs. [124]
M1038 Execution Prevention

Identify and block potentially malicious software executed that may be executed through this technique by using application control [125] tools, like Windows Defender Application Control[126], AppLocker, [127] [128] or Software Restriction Policies [129] where appropriate. [130]

Detection

ID Data Source Data Component
DS0011 Module Module Load
DS0009 Process OS API Execution

Monitoring API calls may generate a significant amount of data and may not be useful for defense unless collected under specific circumstances, since benign use of API functions are common and may be difficult to distinguish from malicious behavior. Correlation of other events with behavior surrounding API function calls using API monitoring will provide additional context to an event that may assist in determining if it is due to malicious behavior. Correlation of activity by process lineage by process ID may be sufficient.

Utilization of the Windows APIs may involve processes loading/accessing system DLLs associated with providing called functions (ex: ntdll.dll, kernel32.dll, advapi32.dll, user32.dll, and gdi32.dll). Monitoring for DLL loads, especially to abnormal/unusual or potentially malicious processes, may indicate abuse of the Windows API. Though noisy, this data can be combined with other indicators to identify adversary activity.

References

  1. The NTinterlnals.net team. (n.d.). Nowak, T. Retrieved June 25, 2020.
  2. Linux Kernel Organization, Inc. (n.d.). The Linux Kernel API. Retrieved June 25, 2020.
  3. de Plaa, C. (2019, June 19). Red Team Tactics: Combining Direct System Calls and sRDI to bypass AV/EDR. Retrieved September 29, 2021.
  4. Gavriel, H. (2018, November 27). Malware Mitigation when Direct System Calls are Used. Retrieved September 29, 2021.
  5. MDSec Research. (2020, December). Bypassing User-Mode Hooks and Direct Invocation of System Calls for Red Teams. Retrieved September 29, 2021.
  6. Microsoft. (n.d.). CreateProcess function. Retrieved December 5, 2014.
  7. Free Software Foundation, Inc.. (2020, June 18). Creating a Process. Retrieved June 25, 2020.
  8. Microsoft. (n.d.). Programming reference for the Win32 API. Retrieved March 15, 2020.
  9. Kerrisk, M. (2016, December 12). libc(7) — Linux manual page. Retrieved June 25, 2020.
  10. glibc developer community. (2020, February 1). The GNU C Library (glibc). Retrieved June 25, 2020.
  11. Microsoft. (n.d.). What is .NET Framework?. Retrieved March 15, 2020.
  12. Apple. (n.d.). Core Services. Retrieved June 25, 2020.
  13. Apple. (2015, September 16). Cocoa Application Layer. Retrieved June 25, 2020.
  14. Apple. (n.d.). Foundation. Retrieved July 1, 2020.
  15. Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017.
  16. Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.
  17. Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.
  18. DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.
  19. CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.
  20. Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.
  21. Security Lab. (2020, June 5). Avaddon: From seeking affiliates to in-the-wild in 2 days. Retrieved August 19, 2021.
  22. Sogeti. (2021, March). Babuk Ransomware. Retrieved August 11, 2021.
  23. Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021.
  24. Sebdraven. (2021, February 8). Babuk is distributed packed. Retrieved August 11, 2021.
  25. Hinchliffe, A. and Falcone, R. (2020, May 11). Updated BackConfig Malware Targeting Government and Military Organizations in South Asia. Retrieved June 17, 2020.
  26. M.Léveille, M-E.. (2017, October 24). Bad Rabbit: Not‑Petya is back with improved ransomware. Retrieved January 28, 2021.
  27. Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.
  28. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
  29. Check Point. (2020, November 26). Bandook: Signed & Delivered. Retrieved May 31, 2021.
  30. Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.
  31. Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.
  32. Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.
  33. Harbison, M. (2021, February 9). BendyBear: Novel Chinese Shellcode Linked With Cyber Espionage Group BlackTech. Retrieved February 16, 2021.
  34. Frankoff, S., Hartley, B. (2018, November 14). Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware. Retrieved January 6, 2021.
  35. Robbins, A., Vazarkar, R., and Schroeder, W. (2016, April 17). Bloodhound: Six Degrees of Domain Admin. Retrieved March 5, 2019.
  36. CheckPoint Research. (2021, July 1). IndigoZebra APT continues to attack Central Asia with evolving tools. Retrieved September 24, 2021.
  37. Trusteer Fraud Prevention Center. (2010, October 7). Carberp Under the Hood of Carberp: Malware & Configuration Analysis. Retrieved July 15, 2020.
  38. Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021.
  39. Cycraft. (2020, April 15). APT Group Chimera - APT Operation Skeleton key Targets Taiwan Semiconductor Vendors. Retrieved August 24, 2020.
  40. Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021.
  41. Cybereason Nocturnus. (2020, December 23). Cybereason vs. Clop Ransomware. Retrieved May 11, 2021.
  42. Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.
  43. Mavis, N. (2020, September 21). The Art and Science of Detecting Cobalt Strike. Retrieved April 6, 2021.
  44. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.
  45. Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.
  46. Rochberger, L. (2021, January 12). Cybereason vs. Conti Ransomware. Retrieved February 17, 2021.
  47. Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021.
  48. Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.
  49. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  50. Check Point Research. (2021, January 4). Stopping Serial Killer: Catching the Next Strike. Retrieved September 7, 2021.
  51. Cybleinc. (2020, October 31). Egregor Ransomware – A Deep Dive Into Its Activities and Techniques. Retrieved December 29, 2020.
  52. Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.
  53. Marschalek, M.. (2014, December 16). EvilBunny: Malware Instrumented By Lua. Retrieved June 28, 2019.
  54. Threat Intelligence and Research. (2015, March 30). VOLATILE CEDAR. Retrieved February 8, 2021.
  55. Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
  56. Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.
  57. Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020.
  58. Trustwave SpiderLabs. (2020, June 25). The Golden Tax Department and Emergence of GoldenSpy Malware. Retrieved July 23, 2020.
  59. Falcone, R., et al. (2018, August 02). The Gorgon Group: Slithering Between Nation State and Cybercrime. Retrieved August 7, 2018.
  60. ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.
  61. Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved July 16, 2021.
  62. Salem, E. (2021, April 19). Dancing With Shellcodes: Cracking the latest version of Guloader. Retrieved July 7, 2021.
  63. Anubhav, A., Jallepalli, D. (2016, September 23). Hancitor (AKA Chanitor) observed using multiple attack approaches. Retrieved August 13, 2020.
  64. Patil, S. and Williams, M.. (2019, June 5). Government Sector in Central Asia Targeted With New HAWKBALL Backdoor Delivered via Microsoft Office Vulnerabilities. Retrieved June 20, 2019.
  65. Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021.
  1. US-CERT. (2020, February 20). MAR-10271944-1.v1 – North Korean Trojan: HOTCROISSANT. Retrieved May 1, 2020.
  2. Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019.
  3. Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020.
  4. Kimayong, P. (2020, June 18). COVID-19 and FMLA Campaigns used to install new IcedID banking malware. Retrieved July 14, 2020.
  5. QiAnXin Threat Intelligence Center. (2019, February 18). APT-C-36: Continuous Attacks Targeting Colombian Government Institutions and Corporations. Retrieved May 5, 2020.
  6. ASERT Team. (2018, April 04). Innaput Actors Utilize Remote Access Trojan Since 2016, Presumably Targeting Victim Files. Retrieved July 9, 2018.
  7. Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
  8. Fernando Merces, Byron Gelera, Martin Co. (2018, June 7). KillDisk Variant Hits Latin American Finance Industry. Retrieved January 12, 2021.
  9. Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019.
  10. Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.
  11. GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.
  12. Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.
  13. Del Fierro, C. Kessem, L.. (2020, January 8). From Mega to Giga: Cross-Version Comparison of Top MegaCortex Modifications. Retrieved February 15, 2021.
  14. Symantec. (2020, November 17). Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign. Retrieved December 17, 2020.
  15. Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.
  16. Zhang, X. (2020, February 4). Another Metamorfo Variant Targeting Customers of Financial Institutions in More Countries. Retrieved July 30, 2020.
  17. ESET, et al. (2018, January). Diplomats in Eastern Europe bitten by a Turla mosquito. Retrieved July 3, 2018.
  18. Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.
  19. Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.
  20. Maniath, S. and Kadam P. (2019, March 19). Dissecting a NETWIRE Phishing Campaign's Usage of Process Hollowing. Retrieved January 7, 2021.
  21. Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.
  22. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  23. Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.
  24. Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.
  25. Vasilenko, R. (2013, December 17). An Analysis of PlugX Malware. Retrieved November 24, 2015.
  26. hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.
  27. Morrow, D. (2021, April 15). The rise of QakBot. Retrieved September 27, 2021.
  28. Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.
  29. Carr, N, et all. (2019, October 10). Mahalo FIN7: Responding to the Criminal Operators’ New Tools and Techniques. Retrieved October 11, 2019.
  30. Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.
  31. Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.
  32. Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.
  33. Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
  34. Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.
  35. Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.
  36. Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.
  37. GReAT. (2017, November 1). Silence – a new Trojan attacking financial organizations. Retrieved May 24, 2019.
  38. Group-IB. (2018, September). Silence: Moving Into the Darkside. Retrieved May 5, 2020.
  39. Prizmant, D. (2021, June 7). Siloscape: First Known Malware Targeting Windows Containers to Compromise Cloud Environments. Retrieved June 9, 2021.
  40. GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021.
  41. The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.
  42. Nicolas Falliere, Liam O. Murchu, Eric Chien. (2011, February). W32.Stuxnet Dossier. Retrieved December 7, 2020.
  43. CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021.
  44. Ivanov, A. et al.. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
  45. Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.
  46. Trend Micro. (2012). The Taidoor Campaign. Retrieved November 12, 2014.
  47. CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021.
  48. Patrick Wardle. (2020, July 3). OSX.EvilQuest Uncovered part ii: insidious capabilities. Retrieved March 21, 2021.
  49. Salinas, M., Holguin, J. (2017, June). Evolution of Trickbot. Retrieved July 31, 2018.
  50. Joe Security. (2020, July 13). TrickBot's new API-Hammering explained. Retrieved September 30, 2021.
  51. Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.
  52. Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.
  53. Vaish, A. & Nemes, S. (2017, November 28). Newly Observed Ursnif Variant Employs Malicious TLS Callback Technique to Achieve Process Injection. Retrieved June 5, 2019.
  54. US-CERT. (2017, November 01). Malware Analysis Report (MAR) - 10135536-D. Retrieved July 16, 2018.
  55. Antenucci, S., Pantazopoulos, N., Sandee, M. (2020, June 23). WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group. Retrieved September 14, 2021.
  56. Su, V. et al. (2019, December 11). Waterbear Returns, Uses API Hooking to Evade Security. Retrieved February 22, 2021.
  57. Wardle, Patrick. (2019, January 15). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 2). Retrieved October 3, 2019.
  58. Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.
  59. Microsoft. (2021, July 2). Use attack surface reduction rules to prevent malware infection. Retrieved June 24, 2021.
  60. Beechey, J. (2010, December). Application Whitelisting: Panacea or Propaganda?. Retrieved November 18, 2014.
  61. Gorzelany, A., Hall, J., Poggemeyer, L.. (2019, January 7). Windows Defender Application Control. Retrieved July 16, 2019.
  62. Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.
  63. NSA Information Assurance Directorate. (2014, August). Application Whitelisting Using Microsoft AppLocker. Retrieved March 31, 2016.
  64. Corio, C., & Sayana, D. P. (2008, June). Application Lockdown with Software Restriction Policies. Retrieved November 18, 2014.
  65. Microsoft. (2012, June 27). Using Software Restriction Policies and AppLocker Policies. Retrieved April 7, 2016.