MITRE ATT&CKtechnique

T1056 Input Capture

Published 2017-05-31 Modified 2025-10-24 Official page ↗

Domain: enterprise
Tactics: Collection, Credential Access
Platforms: Linux, macOS, Network Devices, Windows
Version: 1.4
Created: 2017-05-31

Description

Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).

Tactic · MITRE ATT&CK (2)

TA0006 Credential Access tactic
TA0009 Collection tactic

Referenced by MITRE ATT&CK · subtechnique of (4)

T1056.001 Keylogging sub-technique
T1056.002 GUI Input Capture sub-technique
T1056.003 Web Portal Capture sub-technique
T1056.004 Credential API Hooking sub-technique

Referenced by MITRE ATT&CK · uses (12)

S1245 InvisibleFerret software (malware)
G1046 Storm-1811 group
C0049 Leviathan Australian Intrusions campaign
G1044 APT42 group
C0039 Versa Director Zero Day Exploitation campaign
S1131 NPPSPY software (tool)
S1060 Mafalda software (malware)
S1059 metaMain software (malware)
S0641 Kobalos software (malware)
S0631 Chaes software (malware)
S0381 FlawedAmmyy software (malware)
G0087 APT39 group

Referenced by CAPEC · att&ck technique (2)

CAPEC-569 Collect Data as Provided by Users attack pattern
CAPEC-654 Credential Prompt Impersonation attack pattern

References

http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf Adventures of a Keystroke