TA0006 · CREDENTIAL ACCESS
Credential API Hooking
Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials.
Detect it with
Monitor for calls to the SetWindowsHookEx and SetWinEventHook functions, which install a hook procedure. Also consider analyzing hook chains (which hold pointers to hook procedures for each type of hook) using tools or by programmatically examining internal kernel structures.
Why it matters on shift
Credential API Hooking is one of the concrete ways adversaries achieve credential access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After credential access, the next tactic is usually Discovery. Search your telemetry for the transition before closing the ticket.
Kill-chain context