| ID | Name |
|---|---|
| T1056.001 | Keylogging |
| T1056.002 | GUI Input Capture |
| T1056.003 | Web Portal Capture |
| T1056.004 | Credential API Hooking |
Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.[1] Unlike Keylogging, this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
| ID | Name | Description |
|---|---|---|
| S0484 | Carberp |
Carberp has hooked several Windows API functions to steal credentials.[7] |
| S0363 | Empire |
Empire contains some modules that leverage API hooking to carry out tasks, such as netripper.[8] |
| S0182 | FinFisher |
FinFisher hooks processes by modifying IAT pointers to CreateWindowEx.[9][3] |
| S0353 | NOKKI |
NOKKI uses the Windows call SetWindowsHookEx and begins injecting it into every GUI process running on the victim's machine.[10] |
| G0068 | PLATINUM |
PLATINUM is capable of using Windows hook interfaces for information gathering such as credential access.[11] |
| S0416 | RDFSNIFFER |
RDFSNIFFER hooks several Win32 API functions to hijack elements of the remote system management user-interface.[12] |
| S0266 | TrickBot |
TrickBot has the ability to capture RDP credentials by capturing the |
| S0386 | Ursnif |
Ursnif has hooked APIs to perform a wide variety of information theft, such as monitoring traffic from browsers.[14] |
| S1154 | VersaMem |
VersaMem hooked and overrided Versa's built-in authentication method, |
| S0251 | Zebrocy |
Zebrocy installs an application-defined Windows hook to get notified when a network drive has been attached, so it can then use the hook to call its RecordToFile file stealing method.[16] |
| S0330 | Zeus Panda |
Zeus Panda hooks processes by leveraging its own IAT hooked functions.[17] |
| S0412 | ZxShell |
ZxShell hooks several API functions to spawn system threads.[18] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0009 | Process | OS API Execution |
Monitor for API calls to the SetWindowsHookEx and SetWinEventHook functions, which install a hook procedure.[2][19] Also consider analyzing hook chains (which hold pointers to hook procedures for each type of hook) using tools[19][20][21] or by programmatically examining internal kernel structures.[22][23] |
| Process Metadata |
Verify integrity of live processes by comparing code in memory to that of corresponding static binaries, specifically checking for jumps and other instructions that redirect code flow. |