T1556 Modify Authentication Process
Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts. MITRE ATT&CK
Its sub-techniques
T1556.002Modify Authentication Process: Password Filter DLL