CAPEC-568 Capture Credentials via Keylogger

An adversary deploys a keylogger in an effort to obtain credentials directly from a system's user. After capturing all the keystrokes made by a user, the adversary can analyze the data and determine which string are likely to be passwords or other credential related information.

1. [Explore] [Determine which user's credentials to capture] Since this is a more targeted attack, an adversary will first identify a particular user they wish the capture the credentials of. 2. [Experiment] [Deploy keylogger] Once a user is identified, an adversary will deploy a keylogger to the user's system in one of many ways. 3. [Experiment] [Record keystrokes] Once the keylogger is deployed on the user's system, the adversary will record keystrokes over a period of time. 4. [Experiment] [Analyze data and determine credentials] Using the captured keystrokes, the adversary will be able to determine the credentials of the user. 5. [Exploit] [Use found credentials] After the adversary has found the credentials for the target user, they will then use them to gain access to a system in order to perform some follow-up attack

• The ability to install the keylogger, either in person or remote.

• Strong physical security can help reduce the ability of an adversary to install a keylogger.