TA0002 · EXECUTION
Native API
Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
Detect it with
Monitoring API calls may generate a significant amount of data and may not be useful for defense unless collected under specific circumstances, since benign use of API functions are common and may be difficult to distinguish from malicious behavior.
Why it matters on shift
Native API is one of the concrete ways adversaries achieve execution. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After execution, the next tactic is usually Persistence. Search your telemetry for the transition before closing the ticket.
Kill-chain context