Cross-source coverage
T1056.002 / ATT&CK
Input Capture: GUI Input Capture
9 rules across 4 sources.
From MITRE ATT&CK 19.2
Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control).
Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite. This type of prompt can be used to collect credentials via various languages such as AppleScript and PowerShell. On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. Unix Shell).
Adversaries may also mimic common software authentication requests, such as those from browsers or email clients. This may also be paired with user activity monitoring (i.e., Browser Information Discovery and/or Application Window Discovery) to spoof prompts when users are naturally accessing sensitive sites/data.
- Tactics
- Collection · Credential Access
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:SysmonWinEventLog:PowerShellauditd:SYSCALLlinux:climacos:unifiedlogmacos:osquery
How MITRE says to detect it DET0521
Behavioral Detection of Spoofed GUI Credential Prompts
Windows Analytic 1440
Detects suspicious use of PowerShell,.NET, or script interpreters to spawn processes that mimic UAC prompts, often with credential capture dialogue boxes invoked from non-standard parent processes.
WinEventLog:SysmonEventCode=1WinEventLog:PowerShellEventCode=4103, 4104, 4105, 4106
Linux Analytic 1441
Detects GUI-based credential prompts invoked via zenity/kdialog/dialog or X11 APIs from non-user-facing scripts or background shell sessions, often with authentication-related text.
auditd:SYSCALLexecvelinux:cliTerminal Command History
macOS Analytic 1442
Detects AppleScript or Objective-C usage to generate fake authentication windows (e.g., using display dialog or NSAlert) from user-launched or persistence-related processes.
macos:unifiedlogsubsystem=com.apple.Security or com.apple.applescriptmacos:osqueryprocess_events
elastic/protections-artifacts
4 rules| Detection | Severity | Format |
|---|---|---|
| Potential Credentials Phishing via Osascript | Undefined | Elastic TOML |
| Potential Credential Validation via Sudo from Unusual Parent | Undefined | Elastic TOML |
| Potential User Authentication Prompt Phishing | Undefined | Elastic TOML |
| Runuser Executed via Suspicious Parent | Undefined | Elastic TOML |
SigmaHQ/sigma
3 rules| Detection | Severity | Format |
|---|---|---|
| CredUI.DLL Loaded By Uncommon Process | Medium | Sigma |
| PUA - Mouse Lock Execution | Medium | Sigma |
| GUI Input Capture - macOS | Low | Sigma |
elastic/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| Prompt for Credentials with Osascript | High | Elastic TOML |
splunk/security_content
1 rule| Detection | Severity | Format |
|---|---|---|
| Windows Input Capture Using Credential UI Dll | Undefined | SPL |