Monitor for API calls that can be used to install a hook procedure, such as the SetWindowsHookEx and SetWinEventHook functions.[1][2] Also consider analyzing hook chains (which hold pointers to hook procedures for each type of hook) using tools[2][3][4] or by programmatically examining internal kernel structures.[5][6]
Verify integrity of live processes by comparing code in memory to that of corresponding static binaries, specifically checking for jumps and other instructions that redirect code flow.
| Data Component | Name | Channel |
|---|---|---|
| OS API Execution (DC0021) | Process | None |
| Process Metadata (DC0034) | Process | None |