| ID | Name |
|---|---|
| ATAGS-T1117.001 | Credential API Hooking |
| ATAGS-T1117.002 | GUI Input Capture |
| ATAGS-T1117.003 | Keylogging |
| ATAGS-T1117.004 | Web Portal Capture |
Threat Actors may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials. Malicious hooking mechanisms may capture API or function calls that include parameters that reveal user authentication credentials. Unlike Keylogging, this technique focuses specifically on API functions that include parameters that reveal user credentials.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.