GUI Input Capture (MITRE ATT&CK T1056.002) is a credential access and collection technique. Instead of stealing a password from memory, the adversary asks for it. A dialog box that looks like a normal operating system prompt appears, the user types their password, and the script keeps it. It applies to Windows, macOS and Linux.
How attackers use it
Operating systems already ask for credentials when a program needs more privileges. Adversaries copy that pattern. MITRE describes fake installers that need "additional access" and fake malware removal tools as common cover stories.
The prompt can be built with the scripting tools already on the machine. MITRE lists AppleScript and PowerShell for this, and on Linux, dialog boxes launched from malicious shell scripts or the command line. Prompts can also imitate browser or email client sign in requests, and may be timed using user activity monitoring so they appear when someone is already working in a sensitive app.
How to detect it
MITRE's detection strategy for this technique looks at behavior around the prompt, not the pixels:
- Windows: PowerShell, .NET or script interpreters spawning processes that mimic UAC prompts, often from unusual parent processes.
- Linux: dialog tools such as zenity, kdialog or dialog invoked from background shell sessions or non-interactive scripts, with authentication wording.
- macOS: AppleScript or Objective-C creating fake authentication windows, for example with display dialog or NSAlert, from user-launched or persistence-related processes.
Process creation logs with full command lines are the main data source. Alert when a scripting host that is not a normal parent shows a credential-style dialog.
How to reduce the risk
MITRE lists one mitigation: user training. Teach people that a password prompt out of nowhere, especially one from an Office document or a download they just ran, deserves suspicion. A useful habit is to cancel the prompt and open the real settings or app yourself.
Quick check
Why is a fake prompt hard to block with a preventive control?
It uses ordinary scripting and dialog features that legitimate software also uses. Detection and user awareness carry most of the weight.
Sources
- MITRE ATT&CK, GUI Input Capture: https://attack.mitre.org/techniques/T1056/002
