API Hooking
Definition
A monitoring technique in which the sandbox intercepts calls the malware makes to operating-system API functions. Each intercepted call is logged with its arguments and return value, creating a trace of every system-level action the sample attempts.
- Type
- Dynamic malware analysis monitoring technique
- Target
- Operating-system API calls made by the sample
- Output
- Log of each call with arguments and return value
- Environment
- Run inside a sandbox
Common questions
Why is API hooking more informative than just watching network traffic from the sample?+
Network monitoring only shows communication that actually leaves the machine, while API hooking captures local actions such as file writes, registry changes, and process creation, so it reveals a fuller picture of what the malware attempted even when some behaviour never touches the network.
Can malware detect and evade API hooking during sandbox analysis?+
Yes. Some samples check for hooked functions, unusual call latency, or other sandbox artefacts and alter their behaviour or stay dormant when detected, which is why analysts also use less detectable monitoring approaches alongside API hooking.
Related terms
- Behavioural Analysis
- The examination of what a program does at runtime rather than what its code says at rest. Behavioural analysis captures the actual...
- Evasion Detection
- Malware logic that checks whether the execution environment is a real host or an analysis sandbox. Checks may query hardware identifiers, count...
- MITRE ATT&CK Mapping
- The process of classifying observed malware behaviours against the MITRE ATT&CK framework's taxonomy of adversary tactics and techniques. Sandbox platforms increasingly produce...
- Network Indicator
- A network-based artefact produced by malware at runtime, such as a DNS query, an IP address contacted, an HTTP request path, a...
- Sandbox
- An isolated execution environment, typically a virtual machine, where a malware sample runs under full instrumentation. The sandbox logs all system calls,...