StrikeShark Credential API Hooking via SetWindowsHookEx or CredentialUIBroker

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•3

This rule detects potentially malicious activity involving the CredentialUIBroker.exe process or the use of SetWindowsHookEx API calls. These behaviors are often associated with attempts to intercept user input or dump credentials from system processes.