Intercepting and redirecting a function a program calls; this lets malware see or change data while it is being processed.
Hooking is a technique legitimate software also uses. Malware applies it to authentication functions, keyboard events or network calls to capture passwords in plain text. MITRE ATT&CK
Because the hook has to run inside the target process, it is usually seen together with process injection. MITRE ATT&CK
Code is placed in the memory of the target process. MITRE ATT&CK
The start of the target function is changed to jump to the attacker’s code. MITRE ATT&CK
Parameters are recorded as the call passes through, then the original function runs.
We use cookies to ensure proper operation of our website, analyze usage, and deliver relevant content and advertisements. You can manage your preferences at any time. Cookie Policy