Storm-1811G1046 ↗
Has used a PowerShell script to capture user credentials after prompting a user to authenticate to run a malicious script masquerading as a legitimate update item.1
tfMITRE ATT&CK technique
Input Capture T1056
- Tactics
- Credential Access, Collection
- Platforms
- Linux, macOS, Network Devices, Windows
- Version
- 1.4
- Created
- 31 May 2017
- Last modified
- 24 October 2025
- Contributor
- John Lambert, Microsoft Threat Intelligence Center
Sub-techniques 49 rules across the family · 2 mapped directly to T1056 · 2 of 4 carry rules
Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.7
Tools & malware71st pct
Tools & malware71st percentile · 71% of ATT&CK techniques have this many tools implementing them or fewer.2
Detection rules50th pct
Detection rules50th percentile · 50% of ATT&CK techniques have more detection rules written.Input Capture MITRE reference T1056
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
APT42G1044 ↗
Has used credential harvesting websites.1
APT39G0087 ↗
Has utilized tools to capture mouse movements.1
All 3 groups for this technique
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Versa Director Zero Day ExploitationC0039 ↗
Intercepted and harvested credentials from user logins to compromised devices.1
Leviathan Australian IntrusionsC0049 ↗
Leviathan captured submitted multfactor authentication codes and other technical artifacts related to remote access sessions during Leviathan Australian Intrusions.1
All 2 campaigns for this technique
7 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
InvisibleFerretS1245 ↗
Has collected mouse and keyboard events using “pyWinhook”.1
NPPSPYS1131 ↗
Captures user input into the Winlogon process by redirecting RPC traffic from legitimate listening DLLs within the operating system to a newly registered malicious item that allows for recording logon information in cleartext.1
MafaldaS1060 ↗
Can conduct mouse event logging.1
metaMainS1059 ↗
Can log mouse events.1
KobalosS0641 ↗
Has used a compromised SSH client to capture the hostname, port, username and password used to establish an SSH connection from the compromised host.12
ChaesS0631 ↗
Has a module to perform any API hooking it desires.1
All 7 software entries for this technique · 6 newest in this preview
Offense vs defense T1056
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 0
first rule: 2023 Q1 · 2 of 2 campaigns plottedInput Capture detection strategy DET0102
MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of Input Capture Across Platforms
4 platforms
AN0282 · Windows
Monitors for abnormal process behavior and API calls like SetWindowsHookEx, GetAsyncKeyState, or device input polling commonly used for keystroke logging.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process AccessDC0035 | WinEventLog:Sysmon | EventCode=10 |
| File AccessDC0055 | WinEventLog:Security | EventCode=4663, 4670, 4656 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetImage | Can be scoped to sensitive GUI processes like explorer.exe or winlogon.exe |
| TimeWindow | Time threshold for detecting multiple suspicious accesses |
AN0283 · Linux
Detects use of tools/scripts accessing input devices like /dev/input/* or evdev via suspicious processes lacking GUI context.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | auditd:SYSCALL | ptrace, ioctl |
| File AccessDC0055 | auditd:SYSCALL | open, read |
| File ModificationDC0061 | auditd:SYSCALL | write |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ProcessName | Unusual process accessing device files |
| DevicePath | Typically /dev/input/*, but tunable to exact endpoint config |
AN0284 · macOS
Monitors for TCC-bypassing or unauthorized access to input services like IOHIDSystem or Quartz Event Services used in keylogging or screen monitoring.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:osquery | launchd or process_events |
| Process MetadataDC0034 | macos:unifiedlog | subsystem=com.apple.TCC |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| Service | com.apple.accessibility, com.apple.quartz, etc. depending on the API path used |
| ParentProcess | Unusual parent/child pairings can indicate malicious injection |
AN0285 · Network Devices
Detects web-based credential phishing by analyzing traffic to suspicious URLs that mimic login portals and POST credential content.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Connection CreationDC0082 | NSM:Firewall | proxy or TLS inspection logs |
| Network Traffic ContentDC0085 | NSM:Flow | http.log |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserAgent | Mismatched browser identifiers used by phishing kits |
| URL_Path | Paths resembling known login forms but hosted on unknown domains |