Credential API Hooking (MITRE ATT&CK T1056.004) belongs to the collection and credential access tactics. It affects Windows, Linux and macOS. Adversaries hook Windows API functions or Linux and macOS system functions so that calls carrying credentials pass through code they control first.
Unlike keylogging, which looks at keystroke handling, this technique focuses on functions whose parameters reveal credentials.
How attackers use it
MITRE documents three Windows approaches:
- Hook procedures, which run designated code in response to events such as messages, keystrokes and mouse input.
- Import address table (IAT) hooking, which changes the pointers to imported functions stored in a process.
- Inline hooking, which overwrites the first bytes of an API function to redirect execution.
On Linux and macOS the documented route is environment variables that load shared libraries into a program. LD_PRELOAD is used on Linux and DYLD_INSERT_LIBRARIES on macOS. MITRE's example is hooking the libc read function used by SSH or SCP to capture credentials.
How to detect it
MITRE's strategy has three analytics:
- Windows: correlate memory modification with hook installation functions such as SetWindowsHookEx, plus suspicious module loads in credential sensitive processes like lsass.exe, explorer.exe or winlogon.exe.
- Linux: look for LD_PRELOAD libraries loaded into ssh, sudo or scp, and correlate environment variable injection, unexpected library loads and memory patching.
- macOS: look for DYLD_INSERT_LIBRARIES abuse and changes to the code segment of credential handling binaries.
How to reduce the risk
MITRE says this cannot be easily prevented because it relies on legitimate system features. Focus on visibility: log module loads and process creation, restrict who can set preload variables for privileged tools, and alert on new libraries appearing in credential sensitive processes.
Check your own environment
Linux, read-only checks:
cat /etc/ld.so.preload
env | grep -E 'LD_PRELOAD'
An existing /etc/ld.so.preload file or a preload variable in a login shell is worth explaining. On Windows, confirm that Sysmon event ID 7 (image loaded) is collected for credential sensitive processes.
Quick check
Which environment variable is the Linux route MITRE names?
LD_PRELOAD. The macOS equivalent is DYLD_INSERT_LIBRARIES.
Sources
- MITRE ATT&CK, Credential API Hooking: https://attack.mitre.org/techniques/T1056/004
