Input Capture T1056
Tactics: Collection, Credential Access
Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).
Events covered
10 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 7 | Image loaded |
| Sysmon | Event ID 22 | DNSEvent (DNS query) |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| ESF | exec | Process Execution |
| Linux-Auditd | Event ID 1124 | USER_TTY |
| Linux-Auditd | Event ID 1302 | PATH |
| Linux-Auditd | Event ID 1319 | TTY |
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Authoring guide
These 36 rules share fields, values, and exclusions.
Fields filtered most (46 distinct)
These fields appear most often in rule filters.
Top indicator values (238 distinct)
These values appear most often in rule predicates.
Exclusions (303 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 8 rules
- CredUI.DLL Loaded By Uncommon Process
- DNS Query Request To OneLaunch Update Service
- GUI Input Capture - macOS
- Linux Keylogging with Pam.d
- Potential Keylogger Activity
- Powershell Keylogging
- PUA - Mouse Lock Execution
- Suspicious Network Communication With IPFS
Elastic 20 rules
- GetAsyncKeyState API Call from Suspicious Process
- Keystroke Capture by Unsigned Process
- Keystroke Input Capture via DirectInput
- Keystroke Input Capture via RegisterRawInputDevices
- Keystroke Messages Hooking via SetWindowsHookEx
- Keystrokes Input Capture from a Managed Application
- Keystrokes Input Capture from a Suspicious Module
- Keystrokes Input Capture from Suspicious CallStack
- Keystrokes Input Capture from Unsigned DLL
- Keystrokes Input Capture via PowerShell
- Keystrokes Input Capture via SetWindowsHookEx
- Potential Credential Validation via Sudo from Unusual Parent
- Potential Credentials Phishing via Osascript
- Potential SSH Password Grabbing via strace
- Potential Sudo Hijacking
- Potential User Authentication Prompt Phishing
- PowerShell Keylogging Script
- Prompt for Credentials with Osascript
- Runuser Executed via Suspicious Parent
- Suspicious pbpaste High Volume Activity
Splunk 5 rules
- MacOS Osascript Displaying Suspicious User Prompt
- Mavinject Execution (Sysmon)
- Mavinject Execution (Windows Event Log)
- PowerShell Script Keylogger (PowerShell)
- Windows Input Capture Using Credential UI Dll