T0871 · Execution through API

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T0871 · Execution through API · Sunturai

attack-patternics-attackT0871

Execution through API

attack-pattern--5a2610f6-9fff-41e1-bc27-575ca20383d4

Adversaries may attempt to leverage Application Program Interfaces (APIs) used for communication between control software and the hardware. Specific functionality is often coded into APIs which can be called by software to engage specific functions on a device or other software.

Created: May 21, 2020, 5:43 PM UTC
Modified: Apr 16, 2025, 9:26 PM UTC

5 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Pure Controller Failed	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
External Fabric Module XFM1 is unhealthy	High	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Power Platform - Connector added to a sensitive environment	Low	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Dataverse - New Dataverse application user activity type	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Dataverse - Anomalous application user activity	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License

Showing 5 of 5

Filter in the catalogue

External references

mitre-attackT0871Open reference

Platforms

None

Kill chain phases

execution

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object