T1027.007sub-technique of T1027 Obfuscated Files or Information
Dynamic API Resolution
Windowsnothing on this site yetT1027.007 on attack.mitre.org
Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various Native API functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts. API functions called by malware may leave static artifacts such as strings in payload files.
how MITRE says to see it
Detection Strategy for Dynamic API Resolution via Hash-Based Function Lookups
- Behavioral chain involving suspicious use of GetProcAddress and LoadLibrary following memory allocation and manual mapping, often paired with low entropy strings, abnormal API use without static import tables, or delayed module load behaviors.
the rest of T1027
- T1027.001 Binary Padding
- T1027.002 Software Packing
- T1027.003 Steganography
- T1027.004 Compile After Delivery
- T1027.005 Indicator Removal from Tools
- T1027.006 HTML Smuggling
- T1027.008 Stripped Payloads
- T1027.009 Embedded Payloads
- T1027.010 Command Obfuscation
- T1027.011 Fileless Storage
- T1027.012 LNK Icon Smuggling
- T1027.013 Encrypted/Encoded File
- T1027.014 Polymorphic Code
- T1027.015 Compression
- T1027.016 Junk Code Insertion
- T1027.017 SVG Smuggling
- T1027.018 Invisible Unicode