Input Capture `T1056`

Tactics: Collection, Credential Access

Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).

Events covered

10 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 22	DNSEvent (DNS query)
Security-Auditing	Event ID 4688	A new process has been created.
ESF	exec	Process Execution
Linux-Auditd	Event ID 1124	USER_TTY
Linux-Auditd	Event ID 1302	PATH
Linux-Auditd	Event ID 1319	TTY
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).

Authoring guide

These 35 rules share fields, values, and exclusions.

Fields filtered most (51 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	12	`eq` 11, `in` 1	`exec`, `start`, `creation`, `rename`
`process.Ext.api.name`	11	`eq` 11	`SetWindowsHookEx`, `GetAsyncKeyState`, `RegisterRawInputDevices`, `getasynckeystate`
`Image`	9	`is_not_null` 4, `ends_with` 3, `starts_with` 2, `contains` 1, `eq` 1, `wildcard` 1	`/osascript`, `?:\programdata\`, `?:\users\\appdata\local\temp\7z\`, `?:\users\\appdata\local\temp\bnz.*`, `?:\windows\`
`process_name`	9	`eq` 7, `in` 3	`osascript`, `powershell.exe`, `bash`, `cscript.exe`, `csh`
`process.Ext.api.parameters.hook_type`	8	`eq` 8	`WH_KEYBOARD_LL`
`CommandLine`	7	`contains` 5, `wildcard` 2	`osascriptdisplaydialogauthenticate`, `osascriptdisplaydialogpassphrase`, `osascriptdisplaydialogpassword*`, `-e`, `-encodedcommand`
`process.thread.Ext.call_stack_final_user_module.name`	6	`eq` 2, `wildcard` 2, `is_not_null` 1, `starts_with` 1	`Unknown`, `dinput.dll`, `event0.dll.name`, `libffi.dll`, `lua?.?.dll`
`event.type`	5	`eq` 5	`start`, `end`
`process.code_signature.exists`	5	`eq` 5	`false`
`EventID`	4	`eq` 4	`4688`, `1`, `7`
`host.os.type`	4	`eq` 4
`process.Ext.api.parameters.hook_module`	4	`eq` 4	`null`
`process.Ext.api.parameters.usage`	4	`eq` 4	`KEYBOARD`
`process.Ext.relative_file_creation_time`	4	`le` 4	`500`, `300`, `900`
`process.code_signature.trusted`	4	`eq` 4	`false`

Top indicator values (224 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`process.Ext.api.name`	`eq`	`SetWindowsHookEx` elasticKeystroke Capture by Unsigned Process elasticKeystroke Messages Hooking via SetWindowsHookEx elasticKeystrokes Input Capture from a Managed Application elasticKeystrokes Input Capture from a Suspicious Module elasticKeystrokes Input Capture from Suspicious CallStack elasticKeystrokes Input Capture from Unsigned DLL elasticKeystrokes Input Capture via PowerShell elasticKeystrokes Input Capture via SetWindowsHookEx	8	8
`process.Ext.api.name`	`eq`	`GetAsyncKeyState` elasticGetAsyncKeyState API Call from Suspicious Process elasticKeystrokes Input Capture from a Suspicious Module elasticKeystrokes Input Capture from Suspicious CallStack elasticKeystrokes Input Capture from Unsigned DLL	4	4
`process.Ext.api.name`	`eq`	`RegisterRawInputDevices` elasticKeystroke Input Capture via DirectInput elasticKeystroke Input Capture via RegisterRawInputDevices elasticKeystrokes Input Capture from Suspicious CallStack elasticKeystrokes Input Capture from Unsigned DLL	4	4
`process.Ext.api.parameters.hook_type`	`eq`	`WH_KEYBOARD_LL` elasticKeystroke Capture by Unsigned Process elasticKeystroke Messages Hooking via SetWindowsHookEx elasticKeystrokes Input Capture from a Managed Application elasticKeystrokes Input Capture from a Suspicious Module elasticKeystrokes Input Capture from Suspicious CallStack elasticKeystrokes Input Capture from Unsigned DLL elasticKeystrokes Input Capture via PowerShell elasticKeystrokes Input Capture via SetWindowsHookEx	8	8
`EventType`	`eq`	`exec` elasticPotential Credential Validation via Sudo from Unusual Parent elasticPotential Credentials Phishing via Osascript elasticPotential SSH Password Grabbing via strace elasticPotential User Authentication Prompt Phishing elasticPrompt for Credentials with Osascript elasticRunuser Executed via Suspicious Parent elasticSuspicious pbpaste High Volume Activity	7	576
`EventType`	`eq`	`start` elasticGetAsyncKeyState API Call from Suspicious Process elasticKeystroke Capture by Unsigned Process elasticKeystrokes Input Capture from a Managed Application elasticKeystrokes Input Capture via SetWindowsHookEx	4	391
`event.type`	`eq`	`start` elasticPotential Credential Validation via Sudo from Unusual Parent elasticPotential SSH Password Grabbing via strace elasticPotential User Authentication Prompt Phishing elasticRunuser Executed via Suspicious Parent elasticSuspicious pbpaste High Volume Activity	5	1078
`process.code_signature.exists`	`eq`	`false` elasticGetAsyncKeyState API Call from Suspicious Process elasticKeystroke Capture by Unsigned Process elasticKeystroke Input Capture via DirectInput elasticKeystrokes Input Capture from a Managed Application elasticKeystrokes Input Capture via SetWindowsHookEx	5	119
`process.Ext.api.parameters.hook_module`	`eq`	`null` elasticKeystroke Capture by Unsigned Process elasticKeystroke Messages Hooking via SetWindowsHookEx elasticKeystrokes Input Capture from Suspicious CallStack elasticKeystrokes Input Capture via PowerShell	4	4
`process.Ext.api.parameters.usage`	`eq`	`KEYBOARD` elasticKeystroke Input Capture via DirectInput elasticKeystroke Input Capture via RegisterRawInputDevices elasticKeystrokes Input Capture from Suspicious CallStack elasticKeystrokes Input Capture from Unsigned DLL	4	4
`process.code_signature.trusted`	`eq`	`false` elasticGetAsyncKeyState API Call from Suspicious Process elasticKeystroke Capture by Unsigned Process elasticKeystrokes Input Capture from a Managed Application elasticKeystrokes Input Capture via SetWindowsHookEx	4	115
`ParentImage`	`wildcard`	`/dev/shm/*` elasticPotential Credential Validation via Sudo from Unusual Parent elasticPotential User Authentication Prompt Phishing elasticRunuser Executed via Suspicious Parent	3	17
`ParentImage`	`wildcard`	`/home//` elasticPotential Credential Validation via Sudo from Unusual Parent elasticPotential User Authentication Prompt Phishing elasticRunuser Executed via Suspicious Parent	3	18
`ParentImage`	`wildcard`	`/run/user/*` elasticPotential Credential Validation via Sudo from Unusual Parent elasticPotential User Authentication Prompt Phishing elasticRunuser Executed via Suspicious Parent	3	16
`ParentImage`	`wildcard`	`/tmp/*` elasticPotential Credential Validation via Sudo from Unusual Parent elasticPotential User Authentication Prompt Phishing elasticRunuser Executed via Suspicious Parent	3	19
`ParentImage`	`wildcard`	`/var/run/user/*` elasticPotential Credential Validation via Sudo from Unusual Parent elasticPotential User Authentication Prompt Phishing elasticRunuser Executed via Suspicious Parent	3	16
`ParentImage`	`wildcard`	`/var/tmp/*` elasticPotential Credential Validation via Sudo from Unusual Parent elasticPotential User Authentication Prompt Phishing elasticRunuser Executed via Suspicious Parent	3	19
`ParentImage`	`wildcard`	`/root/*` elasticPotential User Authentication Prompt Phishing elasticRunuser Executed via Suspicious Parent	2	4
`process.Ext.api.parameters.flags`	`contains`	`INPUTSINK` elasticKeystroke Input Capture via RegisterRawInputDevices elasticKeystrokes Input Capture from Suspicious CallStack elasticKeystrokes Input Capture from Unsigned DLL	3	3
`CommandLine`	`contains`	`authentication` sigmaGUI Input Capture - macOS elasticPotential User Authentication Prompt Phishing	2	2
`CommandLine`	`contains`	`password` sigmaGUI Input Capture - macOS elasticPotential User Authentication Prompt Phishing	2	6
`CommandLine`	`wildcard`	`osascriptdisplaydialogauthenticate*` elasticPotential Credentials Phishing via Osascript elasticPrompt for Credentials with Osascript	2	2
`CommandLine`	`wildcard`	`osascriptdisplaydialogpassphrase*` elasticPotential Credentials Phishing via Osascript elasticPrompt for Credentials with Osascript	2	2
`CommandLine`	`wildcard`	`osascriptdisplaydialogpassword*` elasticPotential Credentials Phishing via Osascript elasticPrompt for Credentials with Osascript	2	2
`CommandLine`	`wildcard`	`passdisplaydialog` elasticPotential Credentials Phishing via Osascript elasticPrompt for Credentials with Osascript	2	2
`EventID`	`eq`	`4688` splunkMavinject Execution (Windows Event Log) kustoPowershell Empire Cmdlets Executed in Command Line	2	317
`OriginalFileName`	`eq`	`credui.dll` sigmaCredUI.DLL Loaded By Uncommon Process splunkWindows Input Capture Using Credential UI Dll	2	2
`OriginalFileName`	`eq`	`wincredui.dll` sigmaCredUI.DLL Loaded By Uncommon Process splunkWindows Input Capture Using Credential UI Dll	2	2
`Signature`	`in`	`AutoIt Consulting Ltd` elasticKeystroke Input Capture via DirectInput elasticKeystrokes Input Capture from a Suspicious Module	2	2
`process.Ext.api.metadata.background_callcount`	`ge`	`400` elasticGetAsyncKeyState API Call from Suspicious Process elasticKeystrokes Input Capture from a Suspicious Module	2	2

Exclusions (300 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`Image`	`wildcard`	`?:\program files (x86)\*.exe` elasticGetAsyncKeyState API Call from Suspicious Process elasticKeystroke Capture by Unsigned Process elasticKeystroke Input Capture via RegisterRawInputDevices elasticKeystrokes Input Capture from a Managed Application	4
`Image`	`wildcard`	`?:\program files\*.exe` elasticGetAsyncKeyState API Call from Suspicious Process elasticKeystroke Capture by Unsigned Process elasticKeystroke Input Capture via RegisterRawInputDevices elasticKeystrokes Input Capture from a Managed Application	4
`process.code_signature.trusted`	`eq`	`true` elasticKeystrokes Input Capture from a Suspicious Module elasticKeystrokes Input Capture from Suspicious CallStack elasticKeystrokes Input Capture from Unsigned DLL	3
`user.id`	`eq`	`s-1-5-18` elasticKeystrokes Input Capture from a Managed Application elasticKeystrokes Input Capture via SetWindowsHookEx elasticPowerShell Keylogging Script	3
`CommandLine`	`contains`	`-e with timeout of 3600 seconds` elasticPotential Credentials Phishing via Osascript elasticPrompt for Credentials with Osascript	2
`CommandLine`	`contains`	`encryption key escrow` elasticPotential Credentials Phishing via Osascript elasticPrompt for Credentials with Osascript	2
`Image`	`eq`	`?:\windows\system32\rundll32.exe` elasticGetAsyncKeyState API Call from Suspicious Process elasticKeystroke Input Capture via DirectInput	2
`ParentCommandLine`	`starts_with`	`sudo` elasticPotential Credentials Phishing via Osascript elasticPrompt for Credentials with Osascript	2
`ParentImage`	`eq`	`/bin/bash` elasticPotential Credentials Phishing via Osascript elasticPrompt for Credentials with Osascript	2
`ParentImage`	`eq`	`/usr/bin/sudo` elasticPotential Credentials Phishing via Osascript elasticPrompt for Credentials with Osascript	2
`SignatureStatus`	`eq`	`trusted` elasticKeystroke Input Capture via RegisterRawInputDevices elasticKeystroke Messages Hooking via SetWindowsHookEx	2
`process.Ext.effective_parent.executable`	`wildcard`	`/Applications/Karabiner-Elements.app/Contents/MacOS/Karabiner-Elements` elasticPotential Credentials Phishing via Osascript elasticPrompt for Credentials with Osascript	2
`process.Ext.effective_parent.executable`	`wildcard`	`/Applications/NinjaRMMAgent/programfiles/ninjarmm-macagent` elasticPotential Credentials Phishing via Osascript elasticPrompt for Credentials with Osascript	2
`process.Ext.effective_parent.executable`	`wildcard`	`/Library/Application...` elasticPotential Credentials Phishing via Osascript elasticPrompt for Credentials with Osascript	2
`process.Ext.effective_parent.executable`	`wildcard`	`/Library/Application...` elasticPotential Credentials Phishing via Osascript elasticPrompt for Credentials with Osascript	2

Input Capture `T1056`

Events covered

Authoring guide

Fields filtered most (51 distinct)

Top indicator values (224 distinct)

Exclusions (300 distinct)

Rules under this technique

Sigma 8 rules

Elastic 20 rules

Splunk 4 rules

Kusto 2 rules

Panther 1 rule

Input Capture T1056

Events covered

Authoring guide

Fields filtered most (51 distinct)

Top indicator values (224 distinct)

Exclusions (300 distinct)

Rules under this technique

Sigma 8 rules

Elastic 20 rules

Splunk 4 rules

Kusto 2 rules

Panther 1 rule

Input Capture `T1056`