T1056.001: Keylogging
Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.[1]
Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes.[2] Some methods include:
* Hooking API callbacks used for processing keystrokes. Unlike Credential API Hooking, this focuses solely on API functions intended for processing keystroke data. * Reading raw keystroke data from the hardware buffer. * Windows Registry modifications. * Custom drivers. * Modify System Image may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.[3]
Analyst context for executives and security teams
Keylogging matters because it targets the moment users type secrets, especially when other credential theft methods do not work. For leaders, the practical risk is not the keystroke capture itself but the downstream access it can enable across business systems, cloud portals, VPNs, administrator consoles, and network devices. ATT&CK also notes that adversaries may wait for credentials over time or force reauthentication by clearing browser cookies, which makes this behavior relevant to SOC monitoring, identity response, and incident scoping.
Executive priority
Treat keylogging as a credential-risk and resilience issue, not only as malware. Ask whether endpoint, macOS/Linux, Windows, and network-device monitoring can show when input capture mechanisms, custom drivers, registry changes, or modified system images appear. Prioritize coverage for privileged workstations, administrator systems, remote access paths, and network devices, because captured credentials can create new access opportunities. This technique also has cyber-physical relevance where network devices or operational environments depend on administrator login sessions, as ATT&CK links keylogging to campaigns including the 2015 Ukraine Electric Power Attack.
Technical view
This is sub-technique T1056.001 under Input Capture, mapped to credential-access and collection across Linux, macOS, Network Devices, and Windows. ATT&CK describes several mechanisms: keystroke API callback hooking, raw hardware-buffer reads, Windows Registry modifications, custom drivers, and operating-system hooks in modified network-device images. No official ATT&CK detection text is provided, but relationship context identifies DET0089, Behavioral Detection of Keylogging Activity Across Platforms, as a related detection strategy. SOC and IR teams should validate whether detections are behavior-based rather than relying only on known malware names.
Likely telemetry
- Endpoint process, module, and memory behavior associated with input capture or API callback hooking
- Windows Registry change telemetry where keyboard/input persistence or capture behavior may be represented
- Driver installation or load events, especially custom or unsigned/unexpected drivers
- EDR or host audit events related to unusual access to keyboard/input data paths
- Browser/session evidence showing unusual cookie clearing followed by forced reauthentication, where available
Detection direction
- Start from behavioral analytics aligned to DET0089 rather than signature-only coverage.
- Validate coverage on all ATT&CK-listed platforms actually present in the environment: Linux, macOS, Windows, and Network Devices.
- Tune detections around unauthorized input capture behavior, unexpected hooks, driver activity, registry modification, and modified system image indicators.
- Correlate suspected keylogging with identity events such as fresh logins, MFA prompts, reauthentication, and new access opportunities.
- Account for legitimate software that may interact with keyboard input, such as accessibility, remote administration, or endpoint management tools, to reduce false positives.
Mitigation priorities
- Prioritize hardening and monitoring of privileged endpoints and administrator access paths.
- Maintain strong endpoint controls capable of observing suspicious drivers, hooks, registry changes, and input-capture behavior.
- Use identity controls that reduce the value of captured passwords, such as strong MFA and rapid credential rotation during incidents, while recognizing ATT&CK does not state these prevent keylogging itself.
- Protect network devices through system image integrity practices, controlled administration, and monitoring for unexpected image or configuration changes.
- During incident response, assume credentials typed on a suspected keylogged system may be exposed and scope identity activity accordingly.
Analyst notes and limits
ATT&CK associates this technique with many campaigns and groups, indicating broad historical use across espionage, financial, and disruptive contexts. That relationship context should inform threat modeling, but it should not be treated as proof of current activity in any specific environment. The strongest local assessment will come from correlating host behavior, identity logs, and network-device integrity evidence.
The official ATT&CK object provides no detection guidance text, so detection recommendations here are derived from the described behaviors, platforms, tactics, and the DET0089 relationship. Local tooling, operating system coverage, and logging quality determine whether these behaviors are observable. No claim is made that any organization is exposed or that coverage is guaranteed.
Keylogging
Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.[1]
Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes.[2] Some methods include:
* Hooking API callbacks used for processing keystrokes. Unlike Credential API Hooking, this focuses solely on API functions intended for processing keystroke data. * Reading raw keystroke data from the hardware buffer. * Windows Registry modifications. * Custom drivers. * Modify System Image may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.[3]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1056 | Input Capture | This object subtechnique of Input Capture. |
Groups, software, and campaigns
G0059: Magic Hound
Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.[1][2][3][4][5]
G0087: APT39
APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.[1][2][3][4][5]
G0082: APT38
APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.[1] Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which APT38 stole $81 million, as well as attacks against Bancomext [2] and Banco de Chile [2]; some of their attacks have been destructive.[1][2][3][4]
North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
G1017: Volt Typhoon
Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.[1][2][3][4]. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.[5].
Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations. [6]
G0130: Ajax Security Team
Ajax Security Team is a group that has been active since at least 2010 and believed to be operating out of Iran. By 2014 Ajax Security Team transitioned from website defacement operations to malware-based cyber espionage campaigns targeting the US defense industrial base and Iranian users of anti-censorship technologies.[1]
G0007: APT28
APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]
APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.
G0012: Darkhotel
Darkhotel is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage operations conducted via hotel Internet networks against traveling executives and other select guests. Darkhotel has also conducted spearphishing campaigns and infected victims through peer-to-peer and file sharing networks.[1][2][3]
G0045: menuPass
menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.[1][2]
menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.[3][4][5][6][7][1][2]
G1023: APT5
APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.[1][2][3][4][5][6]
G0131: Tonto Team
Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).[1][2][3][4][5][6]
S0021: Derusbi
S1012: PowerLess
PowerLess is a PowerShell-based modular backdoor that has been used by Magic Hound since at least 2022.[1]
S0643: Peppy
S0670: WarzoneRAT
WarzoneRAT is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly available for purchase since at least late 2018.[1][2]
S0038: Duqu
S0283: jRAT
S0455: Metamorfo
S0045: ADVSTORESHELL
ADVSTORESHELL is a spying backdoor that has been used by APT28 from at least 2012 to 2016. It is generally used for long-term espionage and is deployed on targets deemed interesting after a reconnaissance phase. [1] [2]
S1146: MgBot
S0149: MoonWind
S0152: EvilGrab
S0161: XAgentOSX
C0014: Operation Wocao
Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.[1]
Security researchers assessed the Operation Wocao actors used similar TTPs and tools as APT20, suggesting a possible overlap. Operation Wocao was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.3 | Current bundle | 5b9ad065df7a… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Talos Kimsuky Nov 2021
An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.
Open source URL -
[2]
Adventures of a Keystroke
Tinaztepe, E. (n.d.). The Adventures of a Keystroke: An in-depth look into keyloggers on Windows. Retrieved April 27, 2016.
Open source URL -
[3]
Cisco Blog Legacy Device Attacks
Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.
Open source URL -
[4]
mitre-attack T1056.001Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.