T1056.004 — Credential API Hooking

Tactics: Collection, Credential Access · Platforms: Windows, Linux, macOS

Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials. Malicious hooking mechanisms may capture API or function calls that include parameters that reveal user authentication credentials. Unlike Keylogging, this…

Sub-technique of Input Capture (T1056).

Sigma detection rules (3)

T1056.004 Input Capture: Credential API Hooking

title: "T1056.004 Input Capture: Credential API Hooking"
id: f2432cf2-f73a-4307-9a5f-ebe1d9e4f40b
description: 'Detects unsigned DLL modules loading into lsass.exe as a proxy for hook-DLL injection. (Data Component: Image Load; baseline tier: windows-eventid.) Tune using: SourceProcessAllowlist, SignerAllowlist, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1056/004
author: Shahrukh Khan
date: 2026-06-21
license: MIT
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1056.004

logsource:
  category: image_load
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '7'
    Image|endswith: '\lsass.exe'
    Signed: 'false'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Unsigned third-party credential-provider DLLs.

level: medium

T1056.004 Input Capture: Credential API Hooking

title: "T1056.004 Input Capture: Credential API Hooking"
id: 492d412f-7112-4b3c-85e2-a2ef1da37300
description: 'Detects Linux LD_PRELOAD-based credential hooking via two telemetry paths auditd can actually observe: (1) creation/modification of /etc/ld.so.preload, the system-wide preload list that forces a shared library into every dynamically-linked process including authentication binaries, and (2) execution of env(1) used as a wrapper to set LD_PRELOAD for a specific authentication-related target binary (env captures the assignment as an argv token, unlike a shell directly exporting the variable, which never appears in EXECVE argv). The previous version checked LD_PRELOAD against EXECVE argv of the target binary itself, which never works because environment variables are not argv tokens.'
references:
  - https://attack.mitre.org/techniques/T1056/004
author: Shahrukh Khan
date: 2026-06-03
license: MIT
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1056.004

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_preload_file:
    type: PATH
    name: '/etc/ld.so.preload'
    nametype:
      - CREATE
      - NORMAL
  selection_env_wrapper:
    type: EXECVE
    a0|endswith: '/env'
    a1|startswith: 'LD_PRELOAD='
  selection_target:
    type: EXECVE
    a2|endswith:
      - '/sshd'
      - '/sudo'
      - '/su'
      - '/login'
      - '/scp'
  condition: selection_preload_file or (selection_env_wrapper and selection_target)

falsepositives:
  - Configuration management tools (Ansible, Puppet) legitimately writing /etc/ld.so.preload for approved libraries (e.g. jemalloc, sanitizers); rare legitimate use of env LD_PRELOAD=... <auth binary> for debugging/profiling authentication daemons.

level: high

T1056.004 Input Capture: Credential API Hooking

title: "T1056.004 Input Capture: Credential API Hooking"
id: 1ede817b-1e13-4f0e-9809-eac9e81833db
description: 'Detection of Credential Harvesting via API Hooking. (Retargeted to the image_load macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DYLDInjectedPath, ParentProcessName.'
references:
  - https://attack.mitre.org/techniques/T1056/004
author: Shahrukh Khan
date: 2026-01-29
license: MIT
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1056.004

logsource:
  category: image_load
  product: macos

detection:
  selection:
    ImageLoaded|contains: '/private/tmp/'
  selection_parent:
    Image|contains:
      - '/Safari'
      - '/security'
      - 'loginwindow'
  condition: selection and selection_parent

falsepositives:
  - Legitimate diagnostic dylibs injected via DYLD_INSERT_LIBRARIES for supported debugging workflows.

level: high

Related sub-techniques

Explore