Adversaries may directly interact with the native OS application programming interface (API) to access system functions. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes. [1] These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Functionality provided by native APIs are often also exposed to user-mode applications via interfaces and libraries. For example, functions such as memcpy and direct operations on memory registers can be used to modify user and system memory space.
| ID | Name | Description |
|---|---|---|
| S1006 | PLC-Blaster |
PLC-Blaster uses the system function blocks TCON and TDISCON to initiate and destroy TCP connections to arbitrary systems. Buffers may be sent and received on these connections with TRCV und TSEND system function blocks. [2] |
| S0603 | Stuxnet |
Stuxnet calls system function blocks which are part of the operating system running on the PLC. Theyre used to execute system tasks, such as reading the system clock (SFC1) and generating data blocks on the fly. [3] |
| S1009 | Triton |
Triton's imain.bin payload takes commands from the TsHi.ExplReadRam(Ex), TsHi.ExplWriteRam(Ex) and TsHi.ExplExec functions to perform operations on controller memory and registers using syscalls written in PowerPC shellcode. [4] |
| ID | Mitigation | Description |
|---|---|---|
| M0938 | Execution Prevention |
Minimize the exposure of API calls that allow the execution of code. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0753 | Detection of Native API | AN1885 |
Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host making direct native Operating System (OS) Application Programming Interface (API) calls that bypass the normal ICS vendor Software Development Kit (SDK) abstraction layer -- direct CreateFile calls against raw device paths, DeviceIoControl calls to ICS hardware driver handles -- from a process not a recognized vendor application. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. |
| AN2138 |
Real-time monitoring identifies a process making direct ioctl or mmap syscalls against Industrial Control System (ICS) hardware device files, bypassing the vendor's documented Application Programming Interface (API) layer, from a process not in the recognized ICS application list. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. |
||
| AN2183 |
Use an OT-capable protocol decoder to monitor SNMP requests/responses and identify access to vendor-internal or undocumented OIDs from sources outside the approved NMS inventory, especially SET operations or unusual walks against control-network infrastructure. This is network-protocol observation, not OS API execution; require decoded SNMP transaction content or equivalent packet inspection. |
||
| AN2246 |
Real-time monitoring identifies Industrial Control System (ICS) protocol messages using vendor-specific or undocumented function codes that access device hardware registers directly rather than through the normal ICS application layer, from a source not in the approved engineering workstation list. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. |