Input Capture (MITRE ATT&CK T1056) is a parent technique under the collection and credential access tactics. It applies to Linux, macOS, network devices and Windows. The idea is simple: people type credentials and other data into login pages and system dialogs all day, and an adversary who sits in that path can copy what goes by.
MITRE splits it into four sub-techniques: keylogging, GUI input capture, web portal capture and credential API hooking. Each one has its own guide in this series. This post is the map.
How attackers use it
MITRE separates two styles. Some input capture is transparent to the user, such as hooking the API functions that handle credentials. Other forms rely on tricking the user into typing into something they believe is genuine, such as a spoofed login page or a fake dialog.
The four sub-techniques in short:
- Keylogging records keystrokes through API hooks, raw hardware buffers, registry changes, custom drivers or, on network devices, a modified system image.
- GUI input capture shows a fake operating system or application prompt.
- Web portal capture puts credential logging code on an external login page such as a VPN portal.
- Credential API hooking intercepts functions whose parameters carry credentials.
MITRE's procedure examples include capturing mouse events, using credential harvesting websites, and a compromised SSH client that recorded the host, port, username and password of outgoing connections.
How to detect it
MITRE gives a cross platform detection strategy with four analytics:
- Abnormal process behavior and API calls such as SetWindowsHookEx and GetAsyncKeyState, or device input polling.
- Scripts or processes without a GUI context reading input devices such as /dev/input or evdev on Linux.
- On macOS, unauthorized use of input services such as IOHIDSystem or Quartz Event Services, including TCC bypass.
- Web credential phishing, found by analyzing traffic to suspicious URLs that imitate login portals and POST credentials.
How to reduce the risk
MITRE states that this technique cannot be easily mitigated with preventive controls because it abuses system features. That makes detection, user awareness and protecting the places credentials are typed more important. Multi factor authentication and hardened portals reduce what a captured password is worth, though this page does not list them as official mitigations.
Check your own environment
- List which of your login portals are internet facing and who can edit them.
- Confirm process creation logging with command lines is on for endpoints.
- Decide who owns alerts for unexpected hook installation or input device access.
Quick check
Which sub-technique does not touch the endpoint at all?
Web portal capture. The code lives on the server side login page, so endpoint tools will not see it.
Sources
- MITRE ATT&CK, Input Capture: https://attack.mitre.org/techniques/T1056
