Detecting and Mitigating Web Portal Capture (T1056.003)

Web Portal Capture (MITRE ATT&CK T1056.003) sits under the collection and credential access tactics. The adversary installs code on an externally facing portal, such as a VPN login page, so that usernames and passwords are copied as people sign in. MITRE lists Linux, macOS and Windows as platforms.

How attackers use it

A compromised login page can log the credentials and then let the user in as normal, so nothing looks broken. MITRE notes two situations. It can be done after a compromise, using legitimate administrative access, as a backup way to keep access through external remote services and valid accounts. It can also happen as part of the first break in, by exploiting the externally facing web service.

The result is that the portal itself becomes the collector. Anyone who logs in while the modified page is live is exposed.

How to detect it

MITRE's detection strategy focuses on the files behind the page:

• Unauthorized changes to login-facing web server files, for example index.php or login.js on VPN, single sign on or intranet portals.
• On IIS, tampering with pages such as default.aspx or login.aspx for VPN, OWA or SharePoint, through script injection or unexpected editor processes touching the web root.
• On macOS, edits to locally hosted login pages, linked to cron jobs, background scripts or SUID binaries.

Practical steps: keep file integrity monitoring on portal web roots, compare page and script hashes to a known good copy, and correlate any change with remote access artifacts or web shell behavior.

How to reduce the risk

MITRE lists privileged account management. Do not let administrator accounts that can edit your login portal content be used for daily work on machines exposed to unprivileged browsing or email. Keep those accounts for portal changes only.

Quick check

Sources

• MITRE ATT&CK, Web Portal Capture: https://attack.mitre.org/techniques/T1056/003