Technique:  Native API
ADVSTORESHELL is capable of starting a process using CreateProcess.
Amadey has used a variety of Windows API calls, including GetComputerNameA, GetUserNameA, and CreateProcessA.
AppleSeed has the ability to use multiple dynamically resolved API calls.
It leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.
It has used the Windows API to execute code within a victim's system.
Aria-body has the ability to launch files using ShellExecute.
AsyncRAT has the ability to use OS APIs including CheckRemoteDebuggerPresent.
Attor's dispatcher has used CreateProcessW API for execution.
Avaddon has used the Windows Crypto API to generate an AES key.
AvosLocker has used a variety of Windows API calls, including NtCurrentPeb and GetLogicalDrives.
Babuk can use multiple Windows API calls for actions on compromised hosts including discovery and execution.
BackConfig can leverage API functions such as ShellExecuteA and HttpOpenRequestA in the process of downloading and executing files.
Bad Rabbit has used various Windows API calls.
BADHATCH can utilize Native API functions such as, ToolHelp32 and Rt1AdjustPrivilege to enable SeDebugPrivilege on a compromised machine.
BADNEWS has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute.
Bandook has used the ShellExecuteW() function call.
Bankshot creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA().
Bazar can use various APIs to allocate memory and facilitate code execution/injection.
BBK has the ability to use the CreatePipe API to add a sub-process for execution via cmd.
BendyBear can load and execute modules and Windows Application Programming (API) calls using standard shellcode API hashing.
Bisonal has used the Windows API to communicate with the Service Control Manager to execute a thread.
BitPaymer has used dynamic API resolution to avoid identifiable strings within the binary, including RegEnumKeyW.
Black Basta has the ability to use native APIs for numerous functions including discovery and defense evasion.
It has used built-in API functions.
BloodHound can use .NET API calls in the SharpHound ingestor component to pull Active Directory data.
BoxCaon has used Windows API calls to obtain information about the compromised host.
Brute Ratel C4 can call multiple Windows APIs for execution, to share memory, and defense evasion.
build_downer has the ability to use the WinExec API to execute malware on a compromised host.
Bumblebee can use multiple Native APIs.
CaddyWiper has the ability to dynamically resolve and use APIs, including SeTakeOwnershipPrivilege.
Carberp has used the NtQueryDirectoryFile and ZwQueryDirectoryFile functions to hide files and directories.
Chaes used the CreateFileW() API function with read permissions to access downloaded payloads.
It has used direct Windows system calls by leveraging Dumpert.
Chrommme can use Windows API including WinExec for execution.
Clop has used built-in API functions such as WNetOpenEnumW(), WNetEnumResourceW(), WNetCloseEnum(), GetProcAddress(), and VirtualAlloc().
Cobalt Strike's Beacon payload is capable of running shell commands without cmd.exe and PowerShell commands without powershell.exe
ComRAT can load a PE file from memory or the file system and execute it with CreateProcessW.
Conti has used API calls during execution.
CostaBricks has used a number of API calls, including VirtualAlloc, VirtualFree, LoadLibraryA, GetProcAddress, and ExitProcess.
Cuba has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum.
Cyclops Blink can use various Linux API functions including those for execution and discovery.
DarkTortilla can use a variety of API calls for persistence and defense evasion.
DCSrv has used various Windows API functions, including DeviceIoControl, as part of its encryption process.
DEADEYE can execute the GetComputerNameA and GetComputerNameExA WinAPI functions.
Denis used the IsDebuggerPresent, OutputDebugString, and SetLastError APIs to avoid debugging. Denis used GetProcAddress and LoadLibrary to dynamically resolve APIs. Denis also used the Wow64SetThreadContext API as part of a process hollowing process.
Diavol has used several API calls like GetLogicalDriveStrings, SleepEx, SystemParametersInfoAPI, CryptEncrypt, and others to execute parts of its attack.
Donut code modules use various API functions to load and inject code.
DRATzarus can use various API calls to see if it is running in a sandbox.
Dridex has used the OutputDebugStringW function to avoid malware analysis as part of its anti-debugging technique.
Egregor has used the Windows API to make detection more difficult.
Emotet has used CreateProcess to create a new process to run its executable and WNetEnumResourceW to enumerate non-hidden shares.
Empire contains a variety of enumeration modules that have an option to use API calls to carry out tasks.
EvilBunny has used various API calls as part of its checks to see if the malware is running in a sandbox.
Explosive has a function to call the OpenClipboard wrapper.
FatDuke can call ShellExecuteW to open the default browser on the URL localhost.
Flagpro can use Native API to enable obfuscation including GetLastError and GetTickCount.
FoggyWeb's loader can use API functions to load the FoggyWeb backdoor into the same Application Domain within which the legitimate AD FS managed code is executed.
FunnyDream can use Native API for defense evasion, discovery, and collection.
It malware has used CreateProcess to launch additional malicious components.
Gelsemium has the ability to use various Windows API functions to perform tasks.
gh0st RAT has used the InterlockedExchange, SeShutdownPrivilege, and ExitWindowsEx Windows API functions.
GoldenSpy can execute remote commands in the Windows command shell using the WinExec() API.
Goopy has the ability to  enumerate the infected system's user name via GetUserNameW.
It malware can leverage the Windows API call, CreateProcessA(), for execution.
Grandoreiro can execute through the WinExec API.
GrimAgent can use Native API including GetProcAddress and ShellExecuteW.
GuLoader can use a number of different APIs for discovery and execution.
Hancitor has used CallWindowProc and EnumResourceTypesA to interpret and execute shellcode.
HAWKBALL has leveraged several Windows API calls to create processes, gather disk information, and detect debugger activity.
HermeticWiper can call multiple Windows API functions used for privilege escalation, service execution, and to overwrite random bites of data.
HermeticWizard can connect to remote shares using WNetAddConnection2W.
It has called various native OS APIs.
HotCroissant can perform dynamic DLL importing and API lookups using LoadLibrary and GetProcAddress on obfuscated strings.
HyperBro has the ability to run an application (CreateProcessW) or script/file (ShellExecuteW) via API.
HyperStack can use Windows API's ConnectNamedPipe and WNetAddConnection2 to detect incoming connections and connect to remote shares.
IcedID has called ZwWriteVirtualMemory, ZwProtectVirtualMemory, ZwQueueApcThread, and NtResumeThread to inject itself into a remote process.
Imminent Monitor has leveraged CreateProcessW() call to execute the debugger.
InnaputRAT uses the API call ShellExecuteW for execution.
InvisiMole can use winapiexec tool for indirect execution of  ShellExecuteW and CreateProcessA.
Kevin can use the ShowWindow API to avoid detection.
KillDisk has called the Windows API to retrieve the hard disk handle and shut down the machine.
KOCTOPUS can use the LoadResource and CreateProcessW APIs for execution.
KONNI has hardcoded API calls within its functions to use on the victim's machine.
It has used the Windows API ObtainUserAgentString to obtain the User-Agent from a compromised host to connect to a C2 server. It has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.
LightNeuron is capable of starting a process using CreateProcess.
LitePower can use various API calls.
Lizar has used various Windows API functions on a victim's machine.
Lokibot has used LoadLibrary(), GetProcAddress() and CreateRemoteThread() API functions to execute its shellcode.
MacMa has used macOS API functions to perform tasks.
Mafalda can use a variety of API calls.
MarkiRAT can run the ShellExecuteW API via the Windows Command Shell.
Maze has used several Windows API functions throughout the encryption process including IsDebuggerPresent, TerminateProcess, Process32FirstW, among others.
After escalating privileges, MegaCortex calls TerminateProcess(), CreateRemoteThread, and other Win32 APIs.
It has used native APIs including GetModuleFileName, lstrcat, CreateFile, and ReadFile.
metaMain can execute an operator-provided Windows command by leveraging functions such as WinExec, WriteFile, and ReadFile.
Metamorfo has used native WINAPI calls.
Meteor can use WinAPI to remove a victim machine from an Active Directory domain.
Milan can use the API DnsQuery_A for DNS resolution.
Mis-Type has used Windows API calls, including NetUserAdd and NetUserDel.
Misdat has used Windows APIs, including ExitWindowsEx and GetKeyboardType.
Mosquito leverages the CreateProcess() and LoadLibrary() calls to execute files with the .dll and .exe extensions.
Nebulae has the ability to use CreateProcess to execute a process.
Netwalker can use Windows API functions to inject the ransomware DLL.
NETWIRE can use Native API including CreateProcess GetProcessById, and WriteProcessMemory.
NightClub can use multiple native APIs including GetKeyState, GetForegroundWindow, GetWindowThreadProcessId, and GetKeyboardLayout.
njRAT has used the ShellExecute() function within a script.
During Operation Dream Job, It used Windows API ObtainUserAgentString to obtain the victim's User-Agent and used the value to connect to their C2 server.
During Operation Honeybee, the threat actors deployed malware that used API calls, including CreateProcessAsUser.
During Operation Sharpshooter, the first stage downloader resolved various Windows libraries and APIs, including LoadLibraryA(), GetProcAddress(), and CreateProcessA().
During Operation Wocao, threat actors used the CreateProcessA and ShellExecute API functions to launch commands after being injected into a selected process.
PcShare has used a variety of Windows API functions.
Pillowmint has used multiple native Windows APIs to execute and conduct process injections.
PipeMon's first stage has been executed by a call to CreateProcess with the decryption password in an argument. PipeMon has used a call to LoadLibrary to load its installer.
PLEAD can use ShellExecute to execute applications.
PlugX can use the Windows API functions GetProcAddress, LoadLibrary, and CreateProcess to execute another process.
PolyglotDuke can use LoadLibraryW and CreateProcess to load and execute code.
Pony has used several Windows functions for various purposes.
Prestige has used the Wow64DisableWow64FsRedirection() and Wow64RevertWow64FsRedirection() functions to disable and restore file system redirection.
Pteranodon has used various API calls.
QakBot can use GetProcAddress to help delete malicious strings from memory.
QUIETCANARY can call System.Net.HttpWebRequest to identify the default proxy configured on the victim computer.
The file collection tool used by RainyDay can utilize native API including ReadDirectoryChangeW for folder monitoring.
Ramsay can use Windows API functions such as WriteFile, CloseHandle, and GetCurrentHwProfile during its collection and file storage operations. Ramsay can execute its embedded components via CreateProcessA and ShellExecute.
RCSession can use WinSock API for communication including WSASend and WSARecv.
RDFSNIFFER has used several Win32 API functions to interact with the victim machine.
REvil can use Native API for execution and to retrieve active services.
Rising Sun used dynamic API resolutions to various Windows APIs by leveraging LoadLibrary() and GetProcAddress().
ROKRAT can use a variety of API calls to execute shellcode.
When executing with non-root permissions, RotaJakiro uses the the shmget API to create shared memory between other known RotaJakiro processes. RotaJakiro also uses the execvp API to help its dead process "resurrect".
Royal can use multiple APIs for discovery, communication, and execution.
It can use the FindNextUrlCacheEntryA and FindFirstUrlCacheEntryA functions to search for specific strings within browser history.
Ryuk has used multiple native APIs including ShellExecuteW to run executables,GetWindowsDirectoryW to create folders, and VirtualAlloc, WriteProcessMemory, and CreateRemoteThread for process injection.
S-Type has used Windows APIs, including GetKeyboardType, NetUserAdd, and NetUserDel.
Saint Bot has used different API calls, including GetProcAddress, VirtualAllocEx, WriteProcessMemory, CreateProcessA, and SetThreadContext.
Sardonic has the ability to call Win32 API functions to determine if powershell.exe is running.
SharpDisco can leverage Native APIs through plugins including GetLogicalDrives.
ShimRat has used Windows API functions to install the service and shim.
ShimRatReporter used several Windows API functions to gather information from the infected system.
It has executed malware by calling the API function CreateProcessW.
SideTwist can use GetUserNameW, GetComputerNameW, and GetComputerNameExW to gather information.
It has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.
SILENTTRINITY has the ability to leverage API including GetProcAddress and LoadLibrary.
Siloscape makes various native API calls.
SodaMaster can use RegOpenKeyW to access the Registry.
SombRAT has the ability to respawn itself using ShellExecuteW and CreateProcessW.
StrifeWater can use a variety of APIs for execution.
Stuxnet uses the SetSecurityDescriptorDacl API to reduce object integrity levels.
SUNSPOT used Windows API functions such as MoveFileEx and NtQueryInformationProcess as part of the SUNBURST injection process.
SVCReady can use Windows API calls to gather information from an infected host.
SynAck parses the export tables of system DLLs to locate and call various Windows API functions.
SysUpdate can call the GetNetworkParams API as part of its C2 establishment process.
It has deployed payloads that use Windows API calls on a compromised host.
Taidoor has the ability to use native APIs for execution including GetProcessHeap, GetProcAddress, and LoadLibrary.
ThiefQuest uses various API to perform behaviors such as executing payloads and performing local enumeration.
TinyIt has used WinHTTP, CreateProcess, and other APIs for C2 communications and other functions.
Torisma has used various Windows API calls.
TrickBot uses the Windows API call, CreateProcessW(), to manage execution flow. TrickBot has also used Nt* API functions to perform Process Injection.
It has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.
It and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.
Uroburos can use native Windows APIs including GetHostByName.
Ursnif has used CreateProcessW to create child processes.
Volgmer executes payloads using the Windows API call CreateProcessW().
WarzoneRAT can use a variety of API calls on a compromised host.
WastedLocker's custom crypter, CryptOne, leveraged the VirtualAlloc() API function to help execute the payload.
Waterbear can leverage API functions for execution.
WhisperGate has used the ExitWindowsEx to flush file buffers to disk and stop running processes and other API calls.
WindTail can invoke Apple APIs contentsOfDirectoryAtPath, pathExtension, and (string) compare.
Winnti for Windows can use Native API to create a new process and to start services.
Woody RAT can use multiple native APIs, including WriteProcessMemory, CreateProcess, and CreateRemoteThread for process injection.
XAgentOSX contains the execFile function to execute a specified file on the system using the NSTask:launch method.
xCaon has leveraged native OS function calls to retrieve  victim's network adapter's  information using GetAdapterInfo() API.
ZxShell can leverage native API including RegisterServiceCtrlHandler  to register a service.RegisterServiceCtrlHandler
ZxxZ has used API functions such as Process32First, Process32Next, and ShellExecuteA.