Winter VivernG1035 ↗
Registered and hosted domains to allow for creation of web pages mimicking legitimate government email logon sites to collect logon information.1
- Tactics
- Credential Access, Collection
- Platforms
- Linux, macOS, Windows
- Version
- 1.1
- Created
- 11 February 2020
- Last modified
- 12 May 2026
Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.2
Tools & malware51st pct
Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Web Portal Capture MITRE reference T1056.003
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
All 2 groups for this technique
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Cutting EdgeC0029 ↗
During Cutting Edge, threat actors modified the JavaScript loaded by the Ivanti Connect Secure login page to capture credentials entered.1
Triton Safety Instrumented System AttackC0030 ↗
In the Triton Safety Instrumented System Attack, TEMP.Veles captured credentials as they were being changed by redirecting text-based login codes to websites they controlled.1
All 2 campaigns for this technique
2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
WARPWIRES1116 ↗
Can capture credentials submitted during the web logon process in order to access layer seven applications such as RDP.1
IceAppleS1022 ↗
The IceApple OWA credential logger can monitor for OWA authentication requests and log the credentials.1
All 2 software entries for this technique
Offense vs defense T1056.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Web Portal Capture detection strategy DET0480
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Credential Harvesting via Web Portal Modification
3 platforms
AN1320 · Linux
Detects unauthorized modifications to login-facing web server files (e.g., index.php, login.js) typically tied to VPN, SSO, or intranet portals. Correlates suspicious file changes with remote access artifacts or web shell behavior.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File ModificationDC0061 | auditd:SYSCALL | write |
| Network Traffic ContentDC0085 | NSM:Flow | HTTP Request Logging |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredFilePaths | Target login-related files (e.g., /var/www/html/login.php) for integrity monitoring |
| TimeWindow | Tune detection to correlate file edits and web access within a short duration |
AN1321 · Windows
Detects tampering of IIS-based login pages (e.g., default.aspx, login.aspx) tied to VPN, OWA, or SharePoint via script injection or unexpected editor processes modifying web roots.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Network Traffic ContentDC0085 | WinEventLog:iis | IIS Logs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| FilePath | Define path to monitored IIS web root (e.g., C:\inetpub\wwwroot\login.aspx) |
| ProcessName | Exclude legitimate updates (e.g., msdeploy.exe) and alert on suspicious editors (e.g., notepad.exe, certutil.exe) |
AN1322 · macOS
Detects unauthorized changes to locally hosted login pages on macOS (common in developer VPN environments) and links file edits to cron jobs, background scripts, or SUID binaries.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File ModificationDC0061 | fs:fsusage | Filesystem Access Logging |
| Network Traffic ContentDC0085 | macos:unifiedlog | subsystem=com.apple.WebKit |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| WebRootPath | Specify custom web service directories (e.g., /Library/WebServer/Documents/) |
| AnomalousProcess | Alert on web root changes from non-web processes or scripts |
Do not allow administrator accounts that have permissions to modify the Web content of organization login portals to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.