API hooking is the interception of a function call so software can observe it, change its arguments, or replace its result. In Windows, this is often done by patching user-mode functions, redirecting execution to another routine, or placing a trampoline before the original code runs.
In cyber security, hooking is used by both defenders and attackers. Security tools may hook APIs to monitor process creation, file access, network activity, or credential use. Malware may hook the same APIs to hide behavior, filter what monitoring tools see, block security checks, or return fake results. It can also be combined with in-memory payloads and indirect system calls to weaken user-mode inspection. Because many detectors rely on API visibility, hooking can distort telemetry and make an attack look quieter than it really is.