T1056: Input Capture
Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).
Security context for executives and security teams
Input Capture matters because it turns normal user activity—typing passwords into portals, OS prompts, or applications—into a credential and information collection opportunity. For leaders, the risk is not just malware on an endpoint; the ATT&CK relationships show this behavior can also involve compromised externally facing portals and network/device-oriented environments, making it relevant to identity assurance, remote access resilience, and incident containment decisions.
Executive priority
Prioritize this technique where credential reuse, remote access, privileged administration, VPN or portal access, and managed service or network infrastructure would create high business impact if credentials were captured. Executives should ask whether the organization can prove coverage across Windows, macOS, Linux, and network-device-adjacent services, and whether incident response playbooks treat suspected input capture as both an endpoint compromise and an identity compromise requiring credential rotation, session review, and portal integrity validation.
Technical view
ATT&CK lists Input Capture under collection and credential-access for Linux, macOS, Network Devices, and Windows. The related sub-techniques define the practical validation scope: keylogging, GUI prompt mimicry, web portal capture, and credential API/function hooking. SOC and IR teams should validate controls and detections against those behavior families rather than relying on a single keylogger signature. Relationship context also includes DET0102, Behavioral Detection of Input Capture Across Platforms, indicating that detection strategy should be behavior-oriented and cross-platform. Because MITRE provides no official detection text for the parent technique, local telemetry and sub-technique-specific tests are required to determine real coverage.
Likely telemetry
- Endpoint process, file, module, and security telemetry from Windows, macOS, and Linux systems where user input or credentials are entered
- Authentication logs for interactive logons, remote access, administrative access, and unusual follow-on credential use
- Web server, application, and portal integrity evidence for externally facing login pages and VPN or remote access portals
- Records of changes to authentication components, credential handling paths, or API/function hooking indicators where available
- Network egress and file activity that could show captured credentials or input data being staged or transmitted
Detection direction
- Map detections to the four related sub-techniques: keylogging, GUI input capture, web portal capture, and credential API hooking.
- Validate behavioral detections across the listed platforms rather than assuming Windows-only coverage.
- For web portal capture risk, monitor for unauthorized changes to externally facing login pages and credential-handling application code.
- Tune alerts to distinguish legitimate administrative, accessibility, remote support, or authentication software behavior from suspicious input interception patterns.
- Correlate suspected input capture with downstream authentication anomalies, because the captured data may be used later from a different system or service.
Mitigation priorities
- Start with asset and identity scoping: identify systems, portals, and network services where credential entry creates the highest business impact.
- Harden and monitor externally facing authentication portals, especially remote access and administrative interfaces.
- Limit and review privileged access paths so captured credentials have reduced blast radius.
- Ensure IR playbooks include credential reset, session invalidation, affected portal review, and host forensic collection when input capture is suspected.
- Use platform-appropriate endpoint and application monitoring to support behavior-based detection across Windows, macOS, Linux, and relevant network-device management environments.
Additional notes and limits
The ATT&CK relationships make this parent technique operationally broad: it connects to multiple sub-techniques and to campaigns, groups, and software that have used input capture behavior. The most decision-useful approach is to treat T1056 as a coverage category for credential and user-input interception, then validate the specific sub-techniques present in the environment.
MITRE does not provide official detection text for this parent object in the supplied fields. Telemetry recommendations are defensive evidence classes derived from the supplied platforms, tactics, description, and sub-technique relationships; actual coverage depends on local logging, endpoint visibility, portal architecture, and identity controls. The relationship context should not be interpreted as evidence of active exploitation against any specific organization.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Input Capture
Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1056.001 | KeyloggingSub-technique | Keylogging subtechnique of this object. |
| Enterprise | T1056.002 | GUI Input CaptureSub-technique | GUI Input Capture subtechnique of this object. |
| Enterprise | T1056.004 | Credential API HookingSub-technique | Credential API Hooking subtechnique of this object. |
| Enterprise | T1056.003 | Web Portal CaptureSub-technique | Web Portal Capture subtechnique of this object. |
Groups, software, and campaigns
G1044: APT42
APT42 is an Iranian-sponsored threat group that conducts cyber espionage and surveillance.[1] The group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015.[1] APT42 starts cyber operations through spearphishing emails and/or the PINEFLOWER Android malware, then monitors and collects information from the compromised systems and devices.[1] Finally, APT42 exfiltrates data using native features and open-source tools.[2]
APT42 activities have been linked to Magic Hound by other commercial vendors. While there are behavior and software overlaps between Magic Hound and APT42, they appear to be distinct entities and are tracked as separate entities by their originating vendor.
G1046: Storm-1811
Storm-1811 is a financially-motivated entity linked to Black Basta ransomware deployment. Storm-1811 is notable for unique phishing and social engineering mechanisms for initial access, such as overloading victim email inboxes with non-malicious spam to prompt a fake "help desk" interaction leading to the deployment of adversary tools and capabilities.[1][2][3][4]
G0087: APT39
APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.[1][2][3][4][5]
S1245: InvisibleFerret
InvisibleFerret is a modular python malware that is leveraged for data exfiltration and remote access capabilities.[1][2][3] InvisibleFerret consists of four modules: main, payload, browser, and AnyDesk.[1] InvisibleFerret malware has been leveraged by North Korea-affiliated threat actors identified as DeceptiveDevelopment or Contagious Interview since 2023.[4][2][3][5] InvisibleFerret has historically been introduced to the victim environment through the use of the BeaverTail malware.[6][1][2][3][5]
S1059: metaMain
S1060: Mafalda
S0631: Chaes
Chaes is a multistage information stealer written in several programming languages that collects login credentials, credit card numbers, and other financial information. Chaes was first observed in 2020, and appears to primarily target victims in Brazil as well as other e-commerce customers in Latin America.[1]
S0381: FlawedAmmyy
FlawedAmmyy is a remote access tool (RAT) that was first seen in early 2016. The code for FlawedAmmyy was based on leaked source code for a version of Ammyy Admin, a remote access software.[1]
S0641: Kobalos
Kobalos is a multi-platform backdoor that can be used against Linux, FreeBSD, and Solaris. Kobalos has been deployed against high profile targets, including high-performance computers, academic servers, an endpoint security vendor, and a large internet service provider; it has been found in Europe, North America, and Asia. Kobalos was first identified in late 2019.[1][2]
S1131: NPPSPY
NPPSPY is an implementation of a theoretical mechanism first presented in 2004 for capturing credentials submitted to a Windows system via a rogue Network Provider API item. NPPSPY captures credentials following submission and writes them to a file on the victim system for follow-on exfiltration.[1][2]
C0039: Versa Director Zero Day Exploitation
Versa Director Zero Day Exploitation was conducted by Volt Typhoon from early June through August 2024 as zero-day exploitation of Versa Director servers controlling software-defined wide area network (SD-WAN) applications. Since tracked as CVE-2024-39717, exploitation focused on credential capture from compromised Versa Director servers at managed service providers (MSPs) and internet service providers (ISPs) to enable follow-on access to service provider clients. Versa Director Zero Day Exploitation was followed by the delivery of the VersaMem web shell for both credential theft and follow-on code execution.[1]
C0049: Leviathan Australian Intrusions
Leviathan Australian Intrusions consisted of at least two long-term intrusions against victims in Australia by Leviathan, relying on similar tradecraft such as external service exploitation followed by extensive credential capture and re-use to enable privilege escalation and lateral movement. Leviathan Australian Intrusions were focused on exfiltrating sensitive data including valid credentials for the victim organizations.[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.4 | Current bundle | a9e6096492e1… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023
Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.
Open source URL - [2]Mandiant APT42-untangling
Rozmann, O., et al. (2024, May 1). Uncharmed: Untangling Iran's APT42 Operations. Retrieved October 9, 2024.
Open source URL - [3]rapid7-email-bombing
Tyler McGraw, Thomas Elkins, and Evan McCann. (2024, May 10). Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators. Retrieved January 31, 2025.
Open source URL - [4]SentinelLabs Metador Technical Appendix Sept 2022
SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.
Open source URL - [5]Lumen Versa 2024
Black Lotus Labs. (2024, August 27). Taking The Crossroads: The Versa Director Zero-Day Exploitaiton. Retrieved August 27, 2024.
Open source URL - [6]Cybereason Chaes Nov 2020
Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021.
Open source URL - [7]CISA Leviathan 2024
CISA et al. (2024, July 8). People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action. Retrieved February 3, 2025.
Open source URL - [8]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [9]ESET Kobalos Feb 2021
M.Leveille, M., Sanmillan, I. (2021, February 2). Kobalos – A complex Linux threat to high performance computing infrastructure. Retrieved August 24, 2021.
Open source URL - [10]ESET Kobalos Jan 2021
M.Leveille, M., Sanmillan, I. (2021, January). A WILD KOBALOS APPEARS Tricksy Linux malware goes after HPCs. Retrieved August 24, 2021.
Open source URL - [11]Huntress NPPSPY 2022
Dray Agha. (2022, August 16). Cleartext Shenanigans: Gifting User Passwords to Adversaries With NPPSPY. Retrieved May 17, 2024.
Open source URL - [12]FBI FLASH APT39 September 2020
FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020.
Open source URL - [13]Adventures of a Keystroke
Tinaztepe, E. (n.d.). The Adventures of a Keystroke: An in-depth look into keyloggers on Windows. Retrieved April 27, 2016.
- [14]Adventures of a Keystroke
Tinaztepe, E. (n.d.). The Adventures of a Keystroke: An in-depth look into keyloggers on Windows. Retrieved April 27, 2016.
- [15]Adventures of a Keystroke
Tinaztepe, E. (n.d.). The Adventures of a Keystroke: An in-depth look into keyloggers on Windows. Retrieved April 27, 2016.
- [16]mitre-attackT1056Open source URL
- [17]mitre-attackT1056Open source URL
- [18]mitre-attackT1056Open source URL
- [19]PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023
Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.
Open source URL - [20]Mandiant APT42-untangling
Rozmann, O., et al. (2024, May 1). Uncharmed: Untangling Iran's APT42 Operations. Retrieved October 9, 2024.
Open source URL - [21]rapid7-email-bombing
Tyler McGraw, Thomas Elkins, and Evan McCann. (2024, May 10). Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators. Retrieved January 31, 2025.
Open source URL - [22]SentinelLabs Metador Technical Appendix Sept 2022
SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.
Open source URL - [23]SentinelLabs Metador Technical Appendix Sept 2022
SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.
Open source URL - [24]SentinelLabs Metador Technical Appendix Sept 2022
SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.
Open source URL - [25]Lumen Versa 2024
Black Lotus Labs. (2024, August 27). Taking The Crossroads: The Versa Director Zero-Day Exploitaiton. Retrieved August 27, 2024.
Open source URL - [26]Cybereason Chaes Nov 2020
Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021.
Open source URL - [27]CISA Leviathan 2024
CISA et al. (2024, July 8). People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action. Retrieved February 3, 2025.
Open source URL - [28]Korean FSI TA505 2020
Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
Open source URL - [29]ESET Kobalos Feb 2021
M.Leveille, M., Sanmillan, I. (2021, February 2). Kobalos – A complex Linux threat to high performance computing infrastructure. Retrieved August 24, 2021.
Open source URL - [30]ESET Kobalos Jan 2021
M.Leveille, M., Sanmillan, I. (2021, January). A WILD KOBALOS APPEARS Tricksy Linux malware goes after HPCs. Retrieved August 24, 2021.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.