Techniques › T1027.007 › AN0250
AN0250 Analytic 0250
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Behavioral chain involving suspicious use of GetProcAddress and LoadLibrary following memory allocation and manual mapping, often paired with low entropy strings, abnormal API use without static import tables, or delayed module load behaviors.</p>
- Detects
- T1027.007 Dynamic API Resolution
- Part of
- DET0091 Detection Strategy for Dynamic API Resolution via Hash-Based Function Lookups
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| etw:Microsoft-Windows-Kernel-Process | API tracing / stack tracing via ETW or telemetry-based EDR | DC0021 OS API Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
APILoadWithoutImport | Tunable logic to flag suspicious modules used without static IAT entries |
TimeWindow | Correlates module load to suspicious memory allocation or API lookup within timeframe |
EntropyThreshold | Used to detect obfuscated strings or hashed function names |
StackTraceFilter | Optional filtering of known safe modules or patterns from telemetry |