Storm-1811G1046 ↗
Has used a PowerShell script to capture user credentials after prompting a user to authenticate to run a malicious script masquerading as a legitimate update item.1
tfMITRE ATT&CK technique
Input Capture T1056
- Tactics
- Credential Access, Collection
- Platforms
- Linux, macOS, Network Devices, Windows
- Version
- 1.4
- Created
- 31 May 2017
- Last modified
- 24 October 2025
- Contributor
- John Lambert, Microsoft Threat Intelligence Center
Sub-techniques 410 rules across the family · 2 mapped directly to T1056 · 2 of 4 carry rules
Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 56% of ATT&CK techniques have fewer threat groups attributed.2
CampaignsTop 17%
Campaigns83rd percentile · 73% of ATT&CK techniques have fewer campaigns recorded.7
Tools & malware71st pct
Tools & malware71st percentile · 69% of ATT&CK techniques have fewer tools implementing them.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.