An EDR tool detects that a process is using the Windows API call SetWindowsHookEx. What attack technique does this function commonly enable?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because SetWindowsHookEx installs a system-wide or thread-specific hook procedure that intercepts messages (WH_KEYBOARD_LL for keyboard, WH_MOUSE_LL for mouse) — the primary Windows API used by keyloggers and credential harvesting malware to capture keystrokes. A is wrong because process injection uses APIs like OpenProcess, WriteProcessMemory, and CreateRemoteThread, not SetWindowsHookEx.
Full explanation below image
Full Explanation
B is correct because SetWindowsHookEx installs a system-wide or thread-specific hook procedure that intercepts messages (WH_KEYBOARD_LL for keyboard, WH_MOUSE_LL for mouse) — the primary Windows API used by keyloggers and credential harvesting malware to capture keystrokes. A is wrong because process injection uses APIs like OpenProcess, WriteProcessMemory, and CreateRemoteThread, not SetWindowsHookEx. C is wrong because network hijacking uses WinSock API functions or LSP (Layered Service Provider) injection; SetWindowsHookEx hooks input events. D is wrong because registry persistence uses RegSetValueEx or similar registry APIs, not message hooks.