Engage Goals: EGO0003 Elicit
Engage Approach: EAP0001 Collect
Engage Actions: EAC0014 Software Manipulation, EAC0015 Information Manipulation
Name of Element: Deceptive API Call Hooking with Modified Return Values
Description of Element:
Intercept specific API calls made by applications and return modified or fabricated data to mislead attackers or disrupt their tools. This can be used to conceal sensitive information, trigger errors in attacker utilities, or gather intelligence on their techniques.
Technical Context:
Placement: Implemented as a kernel-mode driver or a user-mode library that intercepts API calls.
Utilize a hooking library like Detours or Frida to intercept API calls. Implement custom logic to analyze the call parameters and return modified data or trigger specific actions based on predefined rules.
Other:
Att&ck/Engage Mapping: T1056 Input Capture, E1501 Honeytrap