{"id":"T1027.007","name":"Dynamic API Resolution","url":"https://attack.mitre.org/techniques/T1027/007","tactics":["stealth"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0091","stix_id":"x-mitre-detection-strategy--063eac3f-9c2a-429a-ad7c-ae7f49158bb2","name":"Detection Strategy for Dynamic API Resolution via Hash-Based Function Lookups","url":"https://attack.mitre.org/detectionstrategies/DET0091","analytics":[{"id":"AN0250","stix_id":"x-mitre-analytic--48a818ac-077b-46ff-b615-bb2958536aef","name":"Analytic 0250","description":"Behavioral chain involving suspicious use of GetProcAddress and LoadLibrary following memory allocation and manual mapping, often paired with low entropy strings, abnormal API use without static import tables, or delayed module load behaviors.","url":"https://attack.mitre.org/detectionstrategies/DET0091#AN0250","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"etw:Microsoft-Windows-Kernel-Process","channel":"API tracing / stack tracing via ETW or telemetry-based EDR","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"etw-microsoft-windows-kernel-process"}],"mutable_elements":[{"field":"APILoadWithoutImport","description":"Tunable logic to flag suspicious modules used without static IAT entries"},{"field":"TimeWindow","description":"Correlates module load to suspicious memory allocation or API lookup within timeframe"},{"field":"EntropyThreshold","description":"Used to detect obfuscated strings or hashed function names"},{"field":"StackTraceFilter","description":"Optional filtering of known safe modules or patterns from telemetry"}],"live":true,"detection_strategies":["DET0091"],"techniques":["T1027.007"]}],"live":true,"version":"1.0","techniques":["T1027.007"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}