MITRE ATT&CKsub-technique

T1056.001 Keylogging

Published 2020-02-11 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Collection, Credential Access
Platforms
Linux, macOS, Network Devices, Windows
Version
1.3
Created
2020-02-11

Description

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems. Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes. Some methods include: • Hooking API callbacks used for processing keystrokes. Unlike Credential API Hooking, this focuses solely on API functions intended for processing keystroke data. • Reading raw keystroke data from the hardware buffer. • Windows Registry modifications. • Custom drivers. • Modify System Image may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1056 Input Capture technique

Tactic · MITRE ATT&CK (2)

Referenced by MITRE ATT&CK · uses (155)

  • S9020 LODEINFO software (malware)
  • S9017 DCRAT software (tool)
  • S9013 DRYHOOK software (malware)
  • S1249 HexEval Loader software (malware)
  • S1245 InvisibleFerret software (malware)
  • S1239 TONESHELL software (malware)
  • S1233 PAKLOG software (malware)
  • S1235 CorKLOG software (malware)
  • S1226 BOOKWORM software (malware)
  • S1207 XLoader software (malware)
  • G1044 APT42 group
  • S1159 DUSTTRAP software (malware)
  • S1149 CHIMNEYSWEEP software (malware)
  • S1146 MgBot software (malware)
  • S1122 Mispadu software (malware)
  • C0029 Cutting Edge campaign
  • S1111 DarkGate software (malware)
  • G1023 APT5 group
  • C0028 2015 Ukraine Electric Power Attack campaign
  • S1090 NightClub software (malware)
  • S1087 AsyncRAT software (tool)
  • G1016 FIN13 group
  • G1017 Volt Typhoon group
  • S1066 DarkTortilla software (malware)
  • S1059 metaMain software (malware)
  • S1050 PcShare software (tool)
  • C0014 Operation Wocao campaign
  • S1044 FunnyDream software (malware)
  • S1012 PowerLess software (malware)
  • S1016 MacMa software (malware)
Show all 155 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-568 Capture Credentials via Keylogger attack pattern

References