MITRE ATT&CKsub-technique

T1417.001 Keylogging

Published 2022-04-05 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Collection, Credential Access
Platforms
Android, iOS
Version
1.1
Created
2022-04-05

Description

Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them. Some methods of keylogging include: • Masquerading as a legitimate third-party keyboard to record user keystrokes. On both Android and iOS, users must explicitly authorize the use of third-party keyboard apps. Users should be advised to use extreme caution before granting this authorization when it is requested. • Abusing accessibility features. On Android, adversaries may abuse accessibility features to record keystrokes by registering an `AccessibilityService` class, overriding the `onAccessibilityEvent` method, and listening for the `AccessibilityEvent.TYPE_VIEW_TEXT_CHANGED` event type. The event object passed into the function will contain the data that the user typed. *Additional methods of keylogging may be possible if root access is available.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1417 Input Capture technique

Tactic · MITRE ATT&CK (2)

Referenced by MITRE ATT&CK · mitigates (2)

  • M1011 User Guidance mitigation
  • M1012 Enterprise Policy mitigation

Referenced by MITRE ATT&CK · uses (20)

  • S9006 VajraSpy software (malware)
  • S9005 DocSwap software (malware)
  • S9004 Crocodilus software (malware)
  • S1231 GodFather software (malware)
  • S1094 BRATA software (malware)
  • S1092 Escobar software (malware)
  • S1083 Chameleon software (malware)
  • S1079 BOULDSPY software (malware)
  • S1062 S.O.V.A. software (malware)
  • S1054 Drinik software (malware)
  • S1055 SharkBot software (malware)
  • S0655 BusyGasper software (malware)
  • S0522 Exobot software (malware)
  • S0478 EventBot software (malware)
  • S0480 Cerberus software (malware)
  • G0112 Windshift group
  • S0422 Anubis software (malware)
  • S0407 Monokle software (malware)
  • S0408 FlexiSpy software (tool)
  • S0406 Gustuff software (malware)

References