MITRE ATT&CK technique · stealth

`T1027.007` Dynamic API Resolution

Sub-technique of T1027 Obfuscated Files or Information

Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defensive analysis. Malware commonly uses various [Native API](https://attack.mitre.org/techniques/T1106) functions provided by the OS to perform various tasks such as those involving processes, files, and other system artifacts. API functions called…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Lazarus Group

Sigma rules to hunt it

SigmaHQ has no rules for this technique.

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.