Credential API Hooking

{
  "id": "ATTACK:enterprise:T1056.004",
  "title": "Credential API Hooking",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1056/004",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--f5946b5e-9408-485f-a7f7-b5efc88909b6",
  "external_id": "T1056.004",
  "domain": "enterprise",
  "created": "2020-02-11T19:01:15.930Z",
  "modified": "2025-10-24T17:49:37.119Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "collection",
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "EyeofRa Detecting Hooking June 2017",
      "url": "https://eyeofrablog.wordpress.com/2017/06/27/windows-keylogger-part-2-defense-against-user-land/"
    },
    {
      "source_name": "Zairon Hooking Dec 2006",
      "url": "https://zairon.wordpress.com/2006/12/06/any-application-defined-hook-procedure-on-my-machine/"
    },
    {
      "source_name": "GMER Rootkits",
      "url": "http://www.gmer.net/"
    },
    {
      "source_name": "MWRInfoSecurity Dynamic Hooking 2015",
      "url": "https://www.mwrinfosecurity.com/our-thinking/dynamic-hooking-techniques-user-mode/"
    },
    {
      "source_name": "Elastic Process Injection July 2017",
      "url": "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
    },
    {
      "source_name": "Intezer Symbiote 2022",
      "url": "https://intezer.com/blog/research/new-linux-threat-symbiote/"
    },
    {
      "source_name": "HighTech Bridge Inline Hooking Sept 2011",
      "url": "https://www.scribd.com/document/68671361/Inline-Hooking-in-Windows"
    },
    {
      "source_name": "Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Ursnif.gen!I&threatId=-2147336918"
    },
    {
      "source_name": "Microsoft Hook Overview",
      "url": "https://msdn.microsoft.com/library/windows/desktop/ms644959.aspx"
    },
    {
      "source_name": "Microsoft Process Snapshot",
      "url": "https://msdn.microsoft.com/library/windows/desktop/ms686701.aspx"
    },
    {
      "source_name": "PreKageo Winhook Jul 2011",
      "url": "https://github.com/prekageo/winhook"
    },
    {
      "source_name": "Jay GetHooks Sept 2011",
      "url": "https://github.com/jay/gethooks"
    },
    {
      "source_name": "StackExchange Hooks Jul 2012",
      "url": "https://security.stackexchange.com/questions/17904/what-are-the-methods-to-find-hooked-functions-and-apis"
    },
    {
      "source_name": "Adlice Software IAT Hooks Oct 2014",
      "url": "https://www.adlice.com/userland-rootkits-part-1-iat-hooks/"
    },
    {
      "source_name": "Volatility Detecting Hooks Sept 2012",
      "url": "https://volatility-labs.blogspot.com/2012/09/movp-31-detecting-malware-hooks-in.html"
    }
  ]
}