A list of the Windows functions a program imports tells an analyst a lot about its purpose. Dynamic API resolution takes that list away.
MITRE tracks this as Dynamic API Resolution, technique T1027.007, a sub-technique of Obfuscated Files or Information in the Stealth tactic. It applies to Windows.
How attackers use it
Malware uses native OS functions for processes, files and other system artifacts. Normally those calls leave static traces: strings in the file and entries in the import address table (IAT) that show the functions the binary can run.
To remove those traces, an adversary obfuscates the function names and resolves them at runtime. MITRE says malware commonly stores hashes of function names instead of literal strings, then uses them to redo the linking and loading itself with functions such as GetProcAddress and LoadLibrary. The hashes may be further hidden with encryption or string tricks that need decoding at runtime. Like software packing, it can change file signatures and hide malicious API calls until the moment they are used.
How to detect it
MITRE's strategy (DET0091) is a behavioral chain: suspicious use of GetProcAddress and LoadLibrary after memory allocation and manual mapping. It is often paired with low entropy strings, API use without a static import table, or delayed module loading.
Most teams cannot watch this at the API level without specialist endpoint tooling. The realistic approach is to rely on endpoint detection products that watch memory behavior and to treat tiny import tables in an otherwise large executable as a reason for a closer look during analysis.
How to reduce the risk
MITRE lists no specific mitigation for this sub-technique. Because the hiding happens inside the binary, the useful defense is behavior based endpoint detection and application control that keeps unknown executables from running.
Quick check
What does dynamic API resolution hide from an analyst?
The functions a binary will call. Names are replaced by hashes and resolved at runtime, so the import table and plain strings reveal little.
Sources
- MITRE ATT&CK, Dynamic API Resolution (T1027.007)
