Applied Cybernetics Group
T1056.003 Web Portal Capture
coverage gap
- Technique
T1056.003- Tactics
- Collection, Credential Access
- Research, 90 days
- 2
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 0
- Elastic, Splunk
- 0
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1056/003
MITRE description
Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service.(Citation: Volexity Virtual Private Keylogging)
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-09-14Group-IB: Smish. Click. Drained: Inside the Smishing Triad’s Phishing Cockpit -
2026-09-03Group-IB: The Outsider Phishing Kit: A Resilient Threat in the Face of Law Enforcement Action
Detection coverage
No rule covers this technique yet. No SigmaHQ, Elastic or Splunk production rule carries its tag, and thrunt hasn't written one. Techniques like this are where the next thrunt rules come from; the gap map has the full list.