T1056 — Input Capture

Technique

T1056

Tactics

Collection, Credential Access

MISP citations

0

KEV CVEs mapped

3

Community rules

2

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1056

MITRE description

Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).

KEV CVEs mapped to this technique

Per MITRE CTID's hand-curated KEV→ATT&CK mappings — these are the actively-exploited vulnerabilities behind this technique's KEV signal.

• CVE-2024-42009
• CVE-2020-8196
• CVE-2020-8195

Detection coverage

SigmaHQ community rules

• Suspicious Network Communication With IPFS (core)
• DNS Query Request To OneLaunch Update Service (core)

Signal counts reflect the current corpus snapshot: MISP citations are regex-extracted from CIRCL OSINT event text and galaxy tags; KEV mappings come from MITRE CTID; community coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting collections) at release r2026-04-01. Rule bodies are not mirrored — links go upstream.