T1106Execution
Native API
Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying…
CVEs7
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.7
Reports0
Detections
14 Sigma rules tagged T1106Native APIT110614 general rules
- Turla Group Named Pipescriticaltest
- BPFDoor Abnormal Process ID or Lock File Accessedhightest
- HackTool - CobaltStrike BOF Injection Patternhightest
- HackTool - HandleKatz Duplicating LSASS Handlehightest
- HackTool - RedMimicry Winnti Playbook Executionhightest
- HackTool - WinPwn Executionhightest
- HackTool - WinPwn Execution - ScriptBlockhightest
- Potential WinAPI Calls Via CommandLinehightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Native API
7 CVEs, by priority. Each link shows its badge.- CVE-2025-20281Cisco Identity Services Engine Injection VulnerabilityCisco · Identity Services EngineKEVPublic exploitCritical · 10.0T1106Native APIT1059Command and Scripting InterpreterMITRE CTID mapping of the KEV entry · how it is exploited97.6%Top 0.1%70.0priority
- CVE-2020-8657EyesOfNetwork Use of Hard-Coded Credentials VulnerabilityMITRE CTID mapping of the KEV entry · how it is exploited91.9%Top 0.18%69.8priority
- CVE-2024-20439Cisco Smart Licensing Utility Static Credential VulnerabilityCisco · Smart Licensing UtilityKEVPublic exploitCritical · 9.8T1106Native APIT1552Unsecured CredentialsMITRE CTID mapping of the KEV entry · primary impact97.1%Top 0.11%69.8priority
- CVE-2025-31200Apple Multiple Products Memory Corruption VulnerabilityApple · Multiple ProductsKEVPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1106Native API+3 moreMITRE CTID mapping of the KEV entry · follow-on activity20.9%Top 2.4%69.4priority
- CVE-2023-1389TP-Link Archer AX-21 Command Injection VulnerabilityMITRE CTID mapping of the KEV entry · how it is exploited>99.9%Top 0.01%69.2priority
- CVE-2025-31201Apple Multiple Products Arbitrary Read and Write VulnerabilityApple · Multiple ProductsKEVPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1106Native API+3 moreMITRE CTID mapping of the KEV entry · follow-on activity14.0%Top 3.5%69.2priority
- CVE-2025-20337Cisco Identity Services Engine Injection VulnerabilityCisco · Identity Services EngineKEVCritical · 10.0T1106Native APIT1059Command and Scripting InterpreterMITRE CTID mapping of the KEV entry · how it is exploited74.5%Top 0.51%64.9priority