Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.(Citation: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017) Unlike [Keylogging](https://attack.mitre.org/techniques/T1056/001),  this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:

* **Hooks procedures**, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs.(Citation: Microsoft Hook Overview)(Citation: Elastic Process Injection July 2017)
* **Import address table (IAT) hooking**, which use modifications to a process’s IAT, where pointers to imported API functions are stored.(Citation: Elastic Process Injection July 2017)(Citation: Adlice Software IAT Hooks Oct 2014)(Citation: MWRInfoSecurity Dynamic Hooking 2015)
* **Inline hooking**, which overwrites the first bytes in an API function to redirect code flow.(Citation: Elastic Process Injection July 2017)(Citation: HighTech Bridge Inline Hooking Sept 2011)(Citation: MWRInfoSecurity Dynamic Hooking 2015)

Credential API Hooking
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1056/004  external_id: T1056.004     source_name: Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017  description: Microsoft. (2017, September 15). TrojanSpy:Win32/Ursnif.gen!I. Retrieved December 18, 2017.  url: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Ursnif.gen!I&threatId=-2147336918     source_name: Microsoft Hook Overview  description: Microsoft. (n.d.). Hooks Overview. Retrieved December 12, 2017.  url: https://msdn.microsoft.com/library/windows/desktop/ms644959.aspx     source_name: Elastic Process Injection July 2017  description: Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017.  url: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process     source_name: Adlice Software IAT Hooks Oct 2014  description: Tigzy. (2014, October 15). Userland Rootkits: Part 1, IAT hooks. Retrieved December 12, 2017.  url: https://www.adlice.com/userland-rootkits-part-1-iat-hooks/     source_name: MWRInfoSecurity Dynamic Hooking 2015  description: Hillman, M. (2015, August 8). Dynamic Hooking Techniques: User Mode. Retrieved December 20, 2017.  url: https://www.mwrinfosecurity.com/our-thinking/dynamic-hooking-techniques-user-mode/     source_name: HighTech Bridge Inline Hooking Sept 2011  description: Mariani, B. (2011, September 6). Inline Hooking in Windows. Retrieved December 12, 2017.  url: https://www.exploit-db.com/docs/17802.pdf     source_name: Volatility Detecting Hooks Sept 2012  description: Volatility Labs. (2012, September 24). MoVP 3.1 Detecting Malware Hooks in the Windows GUI Subsystem. Retrieved December 12, 2017.  url: https://volatility-labs.blogspot.com/2012/09/movp-31-detecting-malware-hooks-in.html     source_name: PreKageo Winhook Jul 2011  description: Prekas, G. (2011, July 11). Winhook. Retrieved December 12, 2017.  url: https://github.com/prekageo/winhook     source_name: Jay GetHooks Sept 2011  description: Satiro, J. (2011, September 14). GetHooks. Retrieved December 12, 2017.  url: https://github.com/jay/gethooks     source_name: Zairon Hooking Dec 2006  description: Felici, M. (2006, December 6). Any application-defined hook procedure on my machine?. Retrieved December 12, 2017.  url: https://zairon.wordpress.com/2006/12/06/any-application-defined-hook-procedure-on-my-machine/     source_name: EyeofRa Detecting Hooking June 2017  description: Eye of Ra. (2017, June 27). Windows Keylogger Part 2: Defense against user-land. Retrieved December 12, 2017.  url: https://eyeofrablog.wordpress.com/2017/06/27/windows-keylogger-part-2-defense-against-user-land/     source_name: GMER Rootkits  description: GMER. (n.d.). GMER. Retrieved December 12, 2017.  url: http://www.gmer.net/     source_name: Microsoft Process Snapshot  description: Microsoft. (n.d.). Taking a Snapshot and Viewing Processes. Retrieved December 12, 2017.  url: https://msdn.microsoft.com/library/windows/desktop/ms686701.aspx     source_name: StackExchange Hooks Jul 2012  description: Stack Exchange - Security. (2012, July 31). What are the methods to find hooked functions and APIs?. Retrieved December 12, 2017.  url: https://security.stackexchange.com/questions/17904/what-are-the-methods-to-find-hooked-functions-and-apis     