Engage Goals: EGO0001 Expose
Engage Approach: EAP0002 Detect
Engage Actions: EAC0001 API Monitoring, EAC0014 Software Manipulation
Name of Element: API Hooking for Credential Theft Detection
Description of Element:
Goal: Detect attempts to steal credentials by hooking API calls related to credential management.
Approach: Monitoring API calls for suspicious activity.
This element hooks API calls related to credential management, such as CredEnumerate or LogonUser. When a suspicious call is detected, the element can log the event, alert security personnel, or even inject a deceptive credential.
Technical Context:
This element utilizes API hooking techniques to intercept calls related to credential management. It can be implemented as a kernel driver or a user-mode library.
Other:
This element can be effective against malware that attempts to steal credentials from memory or by keylogging.