MITRE ATT&CK T1056 Input Capture: Detecting Data Gathering

Input Capture (T1056) collects credentials at the moment they are typed, entered into a prompt or passed to an API, which means password strength and rotation do nothing to stop it. MITRE ATT&CK v20 places the technique in both the Collection and Credential Access tactics, on Linux, macOS, Windows and network devices, and splits it into four sub-techniques: Keylogging (T1056.001), GUI Input Capture (T1056.002), Web Portal Capture (T1056.003) and Credential API Hooking (T1056.004). This page is the detection engineer's view: what each sub-technique looks like, the analytics and log sources ATT&CK v20 attaches to them, the mitigations that change the outcome, and how to respond when capture is found. For keylogger basics, hardware devices and the user-facing story see the Keyloggers Guide; this page does not repeat it.

Key takeaways

• Four sub-techniques, four different telemetry sources. Keylogging shows up as input device and hook access, GUI capture as script-spawned prompts, portal capture as web file changes, and API hooking as library injection into credential-handling processes.
• Keylogging dominates real use. ATT&CK v20 links 115 malware families and 26 groups to T1056.001, far more than the other three sub-techniques combined.
• Web Portal Capture targets your perimeter, not endpoints. ATT&CK describes code added to VPN and other external login pages, often by an attacker who already has administrative access, as a way to keep access.
• Linux and macOS hooking abuses loader variables. LD_PRELOAD and DYLD_INSERT_LIBRARIES can hook functions used by ssh, sudo and scp, which captures administrator and automation credentials on servers.
• Phishing-resistant and non-typed credentials remove the payoff. If the credential that matters is a passkey, certificate or workload token rather than a typed secret, capture yields little.

The technique and its sub-techniques

ATT&CK describes T1056 as methods of capturing user input to obtain credentials or collect information, noting that capture may be transparent to the user (API hooking) or rely on deceiving the user into using what looks like a genuine service (portal capture). Each sub-technique has its own detection strategy in ATT&CK v20.

ATT&CK notes that keylogging is often used when OS Credential Dumping (T1003) does not work, and that adversaries may clear browser cookies to force users to sign in again and speed up capture. See the T1003 OS Credential Dumping guide for that related technique.

Log sources and analytics by platform

The table summarises the analytics ATT&CK v20 attaches to the four detection strategies, with the log sources each one names. Use it to check you collect the right data before writing rules.

Tuning notes

• Accessibility and remote support tools hook input legitimately: build an allowlist by signed publisher and path, and alert on new entries rather than on the API calls themselves.
• LD_PRELOAD is used by some monitoring agents: baseline which libraries are expected on each server class and alert on anything else loaded into ssh, sshd, sudo or scp.
• Web roots change during deployments: correlate login page writes with your release pipeline and alert on writes from interactive sessions, web server processes or outside change windows.

Mitigations that change the outcome

Where identity fits

Input capture is usually discussed as a user problem, but the highest-value captures are administrative and automation credentials. API hooking of ssh, sudo and scp on a jump host collects the passwords and key passphrases operators type to reach production. Web Portal Capture on a VPN or SSO page collects every remote user's credentials, including break-glass and service desk accounts. Keyloggers on build or admin workstations pick up secrets pasted into terminals. Reduce what can be typed: use short-lived certificates or workload identity for automation, keep secrets out of terminals by fetching them from a vault, and require phishing-resistant authentication for administrators. See the Secrets Management Guide.

Implementation and response

Rolling out detection

1. Collect first: confirm Sysmon (event 1, 7, 8, 10, 11, 13, 14), PowerShell script block logging, auditd execve and /dev/input rules, macOS unified log and osquery, and file integrity monitoring on login portal web roots are flowing.
2. Start with portal and API hooking analytics: they are the most specific and protect the most credentials per alert.
3. Run keylogging analytics in alert-only mode for two weeks to build an allowlist of accessibility, remote support and security tools before raising severity.
4. Test safely: validate each rule in a lab with a benign test harness that calls the same APIs or writes to a test login page, then roll out by server and workstation class.

When capture is found

1. Scope the window: identify when capture started, using file creation times, service install events and portal file history.
2. Preserve evidence: keep a copy of the altered portal file, the injected library or the keylogger binary, and memory from affected hosts, before clean-up.
3. Treat every credential entered during the window as exposed: reset passwords, revoke sessions and tokens, and rotate any secrets typed or pasted on the host, including service and automation credentials.
4. Find the access path: portal capture usually means the attacker already had admin access to the portal; investigate that account and the initial entry.
5. Restore from a known-good build for portals and network device images rather than editing out the capture code.

Detection metrics

1. Percentage of Windows endpoints and servers sending Sysmon events 7, 8 and 10.
2. Percentage of Linux jump hosts and admin servers with auditd rules for execve and /dev/input access.
3. Percentage of external login portals under file integrity monitoring with alerts to the SOC.
4. Number of unexplained input hook or LD_PRELOAD findings per month after tuning (should trend to near zero).
5. Percentage of administrator sign-ins using phishing-resistant authentication.
6. Median time from portal file change to SOC triage.

Framework mapping

Common failure patterns

• Watching endpoints but not portals. Login pages on VPN and SSO appliances are rarely under file integrity monitoring, so capture code can sit there for months.
• Resetting only user passwords. Service, automation and break-glass credentials typed on the host during the window are left valid.
• Alerting on every hook API call. Untuned keylogging analytics drown the SOC in accessibility and remote support noise until they are switched off.
• Ignoring loader variables on Linux. LD_PRELOAD set in a shell profile on a jump host is easy to miss without execve auditing.
• Relying on password rotation. A rotated password is captured again the next time it is typed; only removing typed secrets breaks the cycle.

Practitioner checklist

• Collect Sysmon 1, 7, 8, 10, 11, 13 and 14, PowerShell 4104 and Security 4663 on Windows.
• Deploy auditd execve and /dev/input rules on Linux jump hosts and admin servers.
• Put file integrity monitoring on every external login portal web root.
• Separate portal administration accounts from daily-use accounts (M1026).
• Allowlist legitimate input hooking tools by signer and path, then alert on new entries.
• Manage macOS Accessibility and input device permissions centrally through MDM.
• Require phishing-resistant authentication for administrators and remote access.
• On a finding, rotate every credential entered during the capture window, human and non-human.

Standards and references

• MITRE ATT&CK: Input Capture
• MITRE ATT&CK: Keylogging
• MITRE ATT&CK: GUI Input Capture
• MITRE ATT&CK: Web Portal Capture
• MITRE ATT&CK: Credential API Hooking
• Apple: Privacy Preferences Policy Control payload settings
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Keyloggers Guide · T1003 OS Credential Dumping · Infostealer Threat Guide · Phishing-Resistant MFA Guide · ATT&CK Collection Tactic Guide