T1056 Input Capture

Technique: T1056
Tactics: Collection, Credential Access
Research, 90 days: 0
KEV CVEs mapped: 3
SigmaHQ rules: 2
Elastic, Splunk: 5
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1056

MITRE description

Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

Detection coverage

SigmaHQ community rules

Elastic and Splunk rules

Potential SSH Password Grabbing via strace (elastic)
Potential Sudo Hijacking (elastic)
Suspicious pbpaste High Volume Activity (elastic)
Prompt for Credentials with Osascript (elastic)
PowerShell Keylogging Script (elastic)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.