tfMITRE ATT&CK sub-technique

GUI Input Capture T1056.002

Tactics: Credential Access, Collection
Platforms: Linux, macOS, Windows
Version: 1.3
Created: 11 February 2020
Last modified: 12 May 2026
Contributor: Matthew Molyett, @s1air, Cisco Talos

Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control).

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 23%

Tools & malware77th percentile · 77% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules60th pct

Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.

GUI Input Capture MITRE reference T1056.002

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

RedCurlG1039 ↗

Prompts the user for credentials through a Microsoft Outlook pop-up.1 2

created 2024-09-232 references

FIN4G0085 ↗

Has presented victims with spoofed Windows Authentication prompts to collect their credentials.1 2

created 2019-01-312 references

All 2 groups for this technique

13 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

LP-NotesS9036 ↗

Has displayed a fake Windows Security dialog box to prompt for Windows credentials.1

created 2026-04-21MALWAREcarried by 1 group

MuddyViperS9032 ↗

Has displayed a fake Windows Security dialog to gather credentials.1    

created 2026-04-20MALWAREcarried by 1 group

Cuckoo StealerS1153 ↗

Has captured passwords by prompting victims with a “macOS needs to access System Settings” GUI window.1

created 2024-08-20MALWARE

MispaduS1122 ↗

Can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.1 2

created 2024-03-13MALWAREcarried by 1 group

SILENTTRINITYS0692 ↗

SILENTTRINITY's credphisher.py module can prompt a current user for their credentials.1

created 2022-03-23TOOL

XCSSETS0658 ↗

Prompts the user to input credentials using a native macOS dialog box leveraging the system process /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment.1

created 2021-10-05MALWARE

All 13 software entries for this technique · 6 newest in this preview

Offense vs defense T1056.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 1

first rule: 2020 Q3

GUI Input Capture detection strategy DET0521

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection of Spoofed GUI Credential Prompts

Enterprise

3 platforms

AN1440 · Windows

Detects suspicious use of PowerShell, .NET, or script interpreters to spawn processes that mimic UAC prompts, often with credential capture dialogue boxes invoked from non-standard parent processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Command ExecutionDC0064	WinEventLog:PowerShell	EventCode=4103, 4104, 4105, 4106

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLine	Tunable to detect suspicious prompts like 'Enter your password' or 'CredentialRequired'
ParentProcessName	Tune to flag UI prompts spawned from unexpected processes like cmd.exe or user scripts
TimeWindow	Scope correlation of script execution and prompt appearance

AN1441 · Linux

Detects GUI-based credential prompts invoked via zenity/kdialog/dialog or X11 APIs from non-user-facing scripts or background shell sessions, often with authentication-related text.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
Command ExecutionDC0064	linux:cli	Terminal Command History

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExecutableName	Filter zenity/kdialog prompts launched from unexpected parent shells
PromptString	Look for 'password', 'authentication required', or similar tokens

AN1442 · macOS

Detects AppleScript or Objective-C usage to generate fake authentication windows (e.g., using display dialog or NSAlert) from user-launched or persistence-related processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Script ExecutionDC0029	macos:unifiedlog	subsystem=com.apple.Security or com.apple.applescript
Process CreationDC0032	macos:osquery	process_events

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ScriptContent	AppleScript snippets like 'display dialog' or 'with hidden answer'
ProcessPath	Tune out Apple-signed and expected automation tasks

Tests3Executorsbash 2 · PowerShell 1Need elevation0 of 3Have prerequisites0Have cleanup0Platformsmacos, windows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	AppleScript - Prompt User for Password	macos	bash	—	—	—
Prompt User for Password (Local Phishing) Reference: http://fuzzynop.blogspot.com/2014/10/osascript-for-local-phishing.html Attack command osascript -e 'tell app "System Preferences" to activate' -e 'tell app "System Preferences" to activate' -e 'tell app "System Preferences" to display dialog "Software Update requires that you type your password to apply changes." & return & return default answer "" with icon 1 with hidden answer with title "Software Update"' GUID238f8987-445d-4fff-9ec6-423b6e3856e0
02	PowerShell - Prompt User for Password	windows	PowerShell	—	—	—
Prompt User for Password (Local Phishing) as seen in Stitch RAT. Upon execution, a window will appear for the user to enter their credentials. Reference: https://github.com/nathanlopez/Stitch/blob/master/PyLib/askpass.py Attack command # Creates GUI to prompt for password. Expect long pause before prompt is available. $cred = $host.UI.PromptForCredential('Windows Security Update', '',[Environment]::UserName, [Environment]::UserDomainName) # Using write-warning to allow message to show on console as echo and other similar commands are not visable from the Invoke-AtomicTest framework. write-warning $cred.GetNetworkCredential().Password GUID9024af2a-ddfa-464c-8165-1fe01e00167d
03	AppleScript - Spoofing a credential prompt using osascript	macos	bash	—	—	—
Prompt user for password without requiring permissions to send Apple events to System Settings. https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/ Attack command PWD_SPOOF=$(osascript -e 'display dialog "To perform a security update MacOS needs your passphrase." with title "MacOS Security Update" default answer "" with icon stop with hidden answer') echo $PWD_SPOOF GUIDd2849955-24f4-4da9-be45-f0a4bb4c98e4

Tests from Atomic Red Team (MIT licence) · technique definition

GUI Input Capture detections T1056.002

4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

60th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs