An EDR tool detects that a process is using the Windows API call SetWindowsHookEx. What attack technique does this function commonly enable?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — SetWindowsHookEx is what keyloggers use to install a hook that grabs keyboard and mouse messages, so you're looking at input monitoring. It doesn't inject code into another process, hijack network traffic, or write Run-key registry values.
Full Explanation
The keylogging and input monitoring option is correct because SetWindowsHookEx installs a system-wide or thread-specific hook procedure that intercepts messages (WH_KEYBOARD_LL for keyboard, WH_MOUSE_LL for mouse) — the primary Windows API used by keyloggers and credential harvesting malware to capture keystrokes through a Windows message hook. The process injection option is wrong because process injection uses APIs like OpenProcess, WriteProcessMemory, and CreateRemoteThread, not SetWindowsHookEx. The network connection hijacking option is wrong because network hijacking uses WinSock API functions or LSP (Layered Service Provider) injection; SetWindowsHookEx hooks input events. The registry persistence option is wrong because registry persistence uses RegSetValueEx or similar registry APIs, not message hooks.