TA0006 · CREDENTIAL ACCESS
Input Capture
Keyloggers and credential-prompt spoofing capturing what the user types.
Detect it with
SetWindowsHookEx usage; unexpected processes registering raw input devices.
Why it matters on shift
Input Capture is one of the concrete ways adversaries achieve credential access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After credential access, the next tactic is usually Discovery. Search your telemetry for the transition before closing the ticket.
4 sub-techniques
How it shows up in practice
- T1056.001
Keylogging
Adversaries may log user keystrokes to intercept credentials as the user types them.
- T1056.002
GUI Input Capture
Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt.
- T1056.003
Web Portal Capture
Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service.
- T1056.004
Credential API Hooking
Adversaries may hook into Windows application programming interface (API) functions and Linux system functions to collect user credentials.
Kill-chain context