Detecting and Mitigating Keylogging (T1056.001)

Keylogging (MITRE ATT&CK T1056.001) is a collection and credential access technique. The adversary records what a user types so they can pick up passwords and other secrets as they are entered. MITRE lists Linux, macOS, network devices and Windows as platforms, and calls keylogging the most prevalent type of input capture.

It is often a second choice. MITRE says keylogging is likely used to gain new access when OS credential dumping is not effective, and that it may need to run on a system for a long time before a useful credential shows up.

How attackers use it

MITRE lists several ways to intercept keystrokes:

• Hooking the API callbacks that process keystrokes. This is narrower than credential API hooking, because it only targets functions meant for keystroke data.
• Reading raw keystroke data from the hardware buffer.
• Windows Registry modifications.
• Custom drivers.
• On network devices, modifying the system image to get hooks into the operating system that can read raw keystrokes from login sessions.

To get credentials faster, an adversary may also clear browser cookies so users have to sign in again. That detail matters for defenders: a wave of unexpected re-authentication prompts can be a clue, not just an annoyance.

MITRE's procedure examples cover a wide range of implementations, including PowerShell based keyloggers, Python projects that collect keyboard and mouse events, and native API polling every few milliseconds with results written to a temp file. The pattern is consistent. The code is small, it runs quietly, and it stores or sends what it gathers.

How to detect it

MITRE gives four analytics, one per environment:

• Windows: suspicious use of API calls such as SetWindowsHookEx, GetKeyState or polling functions inside non-UI service processes, combined with registry or driver modifications.
• Linux: non-system processes reading /dev/input, or using ptrace or evdev system calls to read keystroke buffers.
• macOS: unauthorized TCC access, or Quartz Event Services (CGEventTapCreate) and IOHID used to install event taps in unexpected processes.
• Network devices: unauthorized system image modification, or remote capture of console keystrokes over telnet or SSH through altered firmware or man in the middle sniffing.

What to log:

• Process creation with full command lines, and module loads.
• Driver installs and service creation on Windows.
• Registry changes in autorun and driver related keys.
• File creation of small, frequently written files in temp locations by processes that have no reason to touch the keyboard.
• Firmware and image integrity on network devices.

A service process with no window that suddenly polls keyboard state is a better signal than any single API name.

How to reduce the risk

MITRE states that this technique cannot be easily mitigated with preventive controls because it abuses system features. So the plan is to shrink the value of what a keylogger can steal and shorten how long it can run:

• Use multi factor authentication so a typed password alone is not enough.
• Restrict driver installation and administrative rights, since custom drivers are on MITRE's list.
• Keep endpoint monitoring on, with alerts for hook installation and input device access.
• Verify network device images and restrict who can change them.
• Do not type secrets into shells or files that live on shared jump hosts.

Try it yourself

Keyloggers are not the only way secrets leak. API keys and tokens in source files can be taken without any keystroke capture. This demo shows how a scan finds them.

Click through it at your own pace, or open it full screen.

Check your own environment

Linux, read-only checks:

ls -l /dev/input/
sudo auditctl -l

The first shows which input devices exist. The second lists loaded audit rules, so you can see whether any rule watches access to them. On Windows, confirm that Sysmon event IDs 1 (process creation), 6 (driver loaded) and 7 (image loaded) are collected from endpoints. On macOS, review which apps hold Input Monitoring permission in System Settings, under Privacy and Security.

Quick check

Sources

• MITRE ATT&CK, Keylogging: https://attack.mitre.org/techniques/T1056/001