Cross-source coverage

T1056 / ATT&CK

Input Capture

49 rules · 48 families across 8 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).

Tactics: Collection · Credential Access
Platforms: Linux · macOS · Network Devices · Windows
Telemetry: WinEventLog:SysmonWinEventLog:Securityauditd:SYSCALLmacos:unifiedlogmacos:osqueryNSM:FlowNSM:Firewall

How MITRE says to detect it DET0102

Behavioral Detection of Input Capture Across Platforms

Windows Analytic 0282

Monitors for abnormal process behavior and API calls like SetWindowsHookEx, GetAsyncKeyState, or device input polling commonly used for keystroke logging.

WinEventLog:Sysmon EventCode=10
WinEventLog:Security EventCode=4663, 4670, 4656

Linux Analytic 0283

Detects use of tools/scripts accessing input devices like /dev/input/* or evdev via suspicious processes lacking GUI context.

auditd:SYSCALL open, read
auditd:SYSCALL write
auditd:SYSCALL ptrace, ioctl

macOS Analytic 0284

Monitors for TCC-bypassing or unauthorized access to input services like IOHIDSystem or Quartz Event Services used in keylogging or screen monitoring.

macos:unifiedlog subsystem=com.apple.TCC
macos:osquery launchd or process_events

Network Devices Analytic 0285

Detects web-based credential phishing by analyzing traffic to suspicious URLs that mimic login portals and POST credential content.

NSM:Flow http.log
NSM:Firewall proxy or TLS inspection logs

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 49 above — a rule tagged a sub-technique covers this technique too.

elastic/protections-artifacts

15 rules

Detection	Severity	Format
GetAsyncKeyState API Call from Suspicious Process	Undefined	Elastic TOML
Keystroke Capture by Unsigned Process	Undefined	Elastic TOML
Keystroke Input Capture via DirectInput	Undefined	Elastic TOML
Keystroke Input Capture via RegisterRawInputDevices	Undefined	Elastic TOML
Keystroke Messages Hooking via SetWindowsHookEx	Undefined	Elastic TOML
Keystrokes Input Capture from a Managed Application	Undefined	Elastic TOML
Keystrokes Input Capture from a Suspicious Module	Undefined	Elastic TOML
Keystrokes Input Capture from Suspicious CallStack	Undefined	Elastic TOML
Keystrokes Input Capture from Unsigned DLL	Undefined	Elastic TOML
Keystrokes Input Capture via PowerShell	Undefined	Elastic TOML

+ 5 more from elastic/protections-artifacts → showing the 10 highest-severity

socfortress/Wazuh-Rules

14 rules

Detection	Severity	Format
Access to potential keylogger file /tmp/.keyboard.log (T1056.001)	High	Wazuh XML
Keylogging attempt detected via PROMPT_COMMAND (logger with process ID and session info)	High	Wazuh XML
Keylogging attempt detected via PROMPT_COMMAND (tee to .bash_history)	High	Wazuh XML
Keylogging attempt using PS2 with logger to .sh_history (T1056.001)	High	Wazuh XML
Potential auditd keylogger detected via auditctl execve rule with key CMDS	High	Wazuh XML
Suspicious PAM modification attempt — Possible keylogging configuration (T1056.001)	High	Wazuh XML
Sysmon - Event 1: Process creation · DLL Injection with mavinject (T1056.004)	High	Wazuh XML
Sysmon - Event 1: Process creation · PowerShell Keylogger Execution (T1056.001)	High	Wazuh XML
Sysmon - Event 1: Process creation · PowerShell PromptForCredential Usage (T1056.002)	High	Wazuh XML
Sysmon - Event 1: Process creation · PowerShell TLS Credential Hooking (T1056.004)	High	Wazuh XML

+ 4 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

SigmaHQ/sigma

8 rules

Detection	Severity	Format
Linux Keylogging with Pam.d	High	Sigma
CredUI.DLL Loaded By Uncommon Process	Medium	Sigma
Potential Keylogger Activity	Medium	Sigma
Powershell Keylogging	Medium	Sigma
PUA - Mouse Lock Execution	Medium	Sigma
DNS Query Request To OneLaunch Update Service	Low	Sigma
GUI Input Capture - macOS	Low	Sigma
Suspicious Network Communication With IPFS	Low	Sigma

elastic/detection-rules

5 rules

Detection	Severity	Format
PowerShell Keylogging Script	High	Elastic TOML
Prompt for Credentials with Osascript	High	Elastic TOML
Potential SSH Password Grabbing via strace	Medium	Elastic TOML
Potential Sudo Hijacking	Medium	Elastic TOML
Suspicious pbpaste High Volume Activity	Medium	Elastic TOML

chainguard-dev/osquery-defense-kit

3 rules · 2 families

Detection	Severity	Format
Detects unexpected programs opening files in /dev on Linux 2 variants	Undefined	osquery SQL
Detects unexpected programs opening files in /dev on Linux 2 variants	Undefined	osquery SQL
Find programs that are sniffing keyboard events on macOS	Undefined	osquery SQL

chronicle/detection-rules

2 rules

Detection	Severity	Format
netwire_rat_detection_via_wscript	Undefined	YARA-L
the_gocgle_malicious_campaign	Undefined	YARA-L

panther-labs/panther-analysis

1 rule

Detection	Severity	Format
MacOS Keyboard Events	Medium	Panther Python

splunk/security_content

1 rule

Detection	Severity	Format
Windows Input Capture Using Credential UI Dll	Undefined	SPL