OS API Execution

Calls made by a process to operating system-provided Application Programming Interfaces (APIs). These calls are essential for interacting with system resources such as memory, files, and hardware, or for performing system-level tasks. Monitoring these calls can provide insight into a process's intent, especially if the process is malicious.

Data Collection Measures:

• Endpoint Detection and Response (EDR) Tools:
  • Leverage tools to monitor API execution behaviors at the process level.
  • Example: Sysmon Event ID 10 captures API call traces for process access and memory allocation.
• Process Monitor (ProcMon):
  • Use ProcMon to collect detailed logs of process and API activity. ProcMon can provide granular details on API usage and identify malicious behavior during analysis.
• Windows Event Logs:
  • Use Event IDs from Windows logs for specific API-related activities:
    • Event ID 4688: A new process has been created (can indirectly infer API use).
    • Event ID 4657: A registry value has been modified (to monitor registry-altering APIs).
• Dynamic Analysis Tools:
  • Tools like Cuckoo Sandbox, Flare VM, or Hybrid Analysis monitor API execution during malware detonation.
• Host-Based Logs:
  • On Linux/macOS systems, leverage audit frameworks (e.g., auditd, strace) to capture and analyze system call usage that APIs map to.
• Runtime Monitors:
  • Runtime security tools like Falco can monitor system-level calls for API execution.
• Debugging and Tracing:
  • Use debugging tools like gdb (Linux) or WinDbg (Windows) for deep tracing of API executions in real time.