Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g.Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g.Web Portal Capture).
| ID | Name | Description |
|---|---|---|
| G0087 | APT39 | |
| G1044 | APT42 | |
| S0631 | Chaes | Chaes has a module to perform any API hooking it desires.[3] |
| S0381 | FlawedAmmyy | FlawedAmmyy can collect mouse events.[4] |
| S1245 | InvisibleFerret | InvisibleFerret has collected mouse and keyboard events using "pyWinhook".[5] |
| S0641 | Kobalos | Kobalos has used a compromised SSH client to capture the hostname, port, username and password used to establish an SSH connection from the compromised host.[6][7] |
| C0049 | Leviathan Australian Intrusions | Leviathan captured submitted multfactor authentication codes and other technical artifacts related to remote access sessions duringLeviathan Australian Intrusions.[8] |
| S1060 | Mafalda | |
| S1059 | metaMain | |
| S1131 | NPPSPY | NPPSPY captures user input into the Winlogon process by redirecting RPC traffic from legitimate listening DLLs within the operating system to a newly registered malicious item that allows for recording logon information in cleartext.[10] |
| G1046 | Storm-1811 | Storm-1811 has used a PowerShell script to capture user credentials after prompting a user to authenticate to run a malicious script masquerading as a legitimate update item.[11] |
| C0039 | Versa Director Zero Day Exploitation | Versa Director Zero Day Exploitation intercepted and harvested credentials from user logins to compromised devices.[12] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0102 | Behavioral Detection of Input Capture Across Platforms | AN0282 | Monitors for abnormal process behavior and API calls like SetWindowsHookEx, GetAsyncKeyState, or device input polling commonly used for keystroke logging. |
| AN0283 | Detects use of tools/scripts accessing input devices like /dev/input/* or evdev via suspicious processes lacking GUI context. | ||
| AN0284 | Monitors for TCC-bypassing or unauthorized access to input services like IOHIDSystem or Quartz Event Services used in keylogging or screen monitoring. | ||
| AN0285 | Detects web-based credential phishing by analyzing traffic to suspicious URLs that mimic login portals and POST credential content. |