Technique T1106

Native API

CLEARED FOR PUBLIC RELEASE · OPEN-SOURCE INTELLIGENCE

Native API (T1106) — a Execution technique, observed in public incident reporting.

MITRE ATT&CKT1106

TacticExecution

Incidents on file23

Detection & mitigation

Monitor for direct system call invocation via syscall instruction, especially from non-standard or newly created processes. Deploy kernel-level callbacks or ETW providers that can trace system call activity. Use behavior-based detection to identify anomalous process behavior indicative of ransomware, such as mass file encryption or deletion of shadow copies.

Observed in the wild

2026-06-25

direct syscalls
Mistic Ransomware Uses Hell's Gate Technique to Evade Endpoint Detection

2026-05-04

direct syscalls
Tenebris-Gate Multi-Layered Evasion Framework Bypasses Windows Defender

2026-05-04

direct syscalls
Researcher Demonstrates Detection Evasion Techniques Using API Hashing and Syscall Obfuscation

2026-04-29

direct syscalls
Hades Gate: First-Principles Direct Syscall Technique for EDR/AV Bypass

2026-03-15

direct syscalls
Polymorphic x64 shellcode loader with multiple EDR evasion techniques published on GitHub

2026-02-23

direct syscalls
SysWhispers4: Advanced AV/EDR Evasion via Direct and Indirect System Calls

2026-01-22

direct syscalls
MultiLang-Evasion-Framework: A Modular Red Team Payload Framework with Advanced Evasion Techniques

2025-12-17

direct syscalls
macOS EDR Evasion Using Lesser-Known Languages and Native APIs

2025-11-24

direct syscalls
Offensive Programming with Nim: EDR Evasion via Direct Syscalls and Unhooking

2025-11-03

direct syscalls
StyxLoaderX: Modular EDR Evasion Framework Published on GitHub

2025-08-06

direct syscalls
Research Evaluates Four Evasion Techniques Against Microsoft Defender for Endpoint and Cloud AI

2025-07-18

direct syscalls
AI-Assisted Custom Loader Evades Multiple Endpoint Security Platforms

2025-07-07

direct syscalls
RingReaper Linux Malware Uses io_uring for EDR Evasion

2025-04-11

direct syscalls
Arsenal 2.0: Direct Syscall and Static Evasion Techniques to Bypass EDR

2024-12-23

direct syscalls
Hit-And-Run: Bypass EDRs via VEH and Call Stack Theft

2024-07-24

direct syscalls
SyscallTempering: EDR Evasion via Hardware Breakpoint Syscall Argument Spoofing

2024-05-18

direct syscalls
Proof-of-Concept: Hells Gate EDR Evasion via Direct Syscalls in Rust

2024-05-08

direct syscalls
Dirty Vanity EDR Bypass Technique Published as Proof-of-Concept

2024-03-22

direct syscalls
HookChain EDR Evasion Framework Released

2024-01-25

direct syscalls
Indirect Syscall Proof-of-Concept Published to Bypass EDR Userland Hooks

2023-10-25

direct syscalls
Malice: A Go-based Malware Development and EDR Evasion Toolkit Published on GitHub

2023-10-08

direct syscalls
Callstack Spoofing and Indirect Syscalls Proof-of-Concept Dropper Published

2023-07-20

direct syscalls
EDR Call Stack Evasion via Windows Callback Functions

Track this in real time.

ColdRecon watches the public signal so you don't have to — a daily brief and a live detection-coverage desk. Request clearance.

Request Clearance →