{"id":"T1056.001","name":"Keylogging","url":"https://attack.mitre.org/techniques/T1056/001","tactics":["collection","credential-access"],"platforms":["Linux","macOS","Network Devices","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0089","stix_id":"x-mitre-detection-strategy--fe0d7d82-1575-4685-9a4f-4bf83e0227a0","name":"Behavioral Detection of Keylogging Activity Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0089","analytics":[{"id":"AN0243","stix_id":"x-mitre-analytic--7924d1b1-a512-425f-b397-9e9b9887b21b","name":"Analytic 0243","description":"Monitors suspicious usage of Windows API calls like SetWindowsHookEx, GetKeyState, or polling functions within non-UI service processes, combined with Registry or driver modifications.","url":"https://attack.mitre.org/detectionstrategies/DET0089#AN0243","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:System","channel":"EventCode=7045","data_component":"DC0060","data_component_name":"Service Creation","log_source_slug":"wineventlog-system"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TargetImage","description":"Scope to sensitive GUI/session processes like winlogon.exe or osk.exe"},{"field":"AccessMask","description":"Can be tuned to 0x1fffff for full-access injection detection"},{"field":"TimeWindow","description":"Tunable for sustained polling or multiple registry edits in short succession"}],"live":true,"detection_strategies":["DET0089"],"techniques":["T1056.001"]},{"id":"AN0244","stix_id":"x-mitre-analytic--0c122a8e-bcb0-4756-8a63-193c52d61d90","name":"Analytic 0244","description":"Detects non-system processes accessing /dev/input/* or issuing ptrace/evdev syscalls used for reading keystroke buffers directly.","url":"https://attack.mitre.org/detectionstrategies/DET0089#AN0244","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open, read","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"ptrace, ioctl","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"ProcessName","description":"Exclude known good applications (e.g. Xorg, GNOME Shell)"},{"field":"DevicePath","description":"Typically /dev/input/event*, but tunable to match custom input buses"}],"live":true,"detection_strategies":["DET0089"],"techniques":["T1056.001"]},{"id":"AN0245","stix_id":"x-mitre-analytic--da140e65-e30c-4cf2-8961-82fb200a7f0b","name":"Analytic 0245","description":"Detects unauthorized TCC access or use of Quartz Event Services (CGEventTapCreate) or IOHID for event tap installation within unexpected processes.","url":"https://attack.mitre.org/detectionstrategies/DET0089#AN0245","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"subsystem=com.apple.TCC","data_component":"DC0034","data_component_name":"Process Metadata","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"process_events OR launchd","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"Service","description":"com.apple.inputmonitoring, com.apple.accessibility, etc."},{"field":"ExecutablePath","description":"Tunable to exclude trusted endpoint monitoring tools"}],"live":true,"detection_strategies":["DET0089"],"techniques":["T1056.001"]},{"id":"AN0246","stix_id":"x-mitre-analytic--63a1b615-8389-4776-a79c-6db04037a7b7","name":"Analytic 0246","description":"Keylogging on legacy network devices via unauthorized system image modification or remote capture of console keystrokes (telnet, SSH) through altered firmware or man-in-the-middle key sniffing.","url":"https://attack.mitre.org/detectionstrategies/DET0089#AN0246","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:syslog","channel":"Image Upgrade / Configuration Change","data_component":"DC0004","data_component_name":"Firmware Modification","log_source_slug":"networkdevice-syslog"},{"name":"NSM:Flow","channel":"packet capture or DPI logs","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"FirmwareVersion","description":"Baseline hash or expected version for config/image integrity"},{"field":"Protocol","description":"Scope to plaintext channels or low-assurance SSH versions"}],"live":true,"detection_strategies":["DET0089"],"techniques":["T1056.001"]}],"live":true,"version":"1.0","techniques":["T1056.001"]}],"sigma_rules":[{"id":"34f90d3c-c297-49e9-b26d-911b05a4866c","title":"Powershell Keylogging","author":"frack113","status":"test","level":"medium","date":"2021-07-30","modified":"2022-07-11","description":"Adversaries may log user keystrokes to intercept credentials as the user types them.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/src/Get-Keystrokes.ps1"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.collection","attack.t1056.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_keylogging.yml","techniques":["T1056.001"],"cves":[]},{"id":"49aae26c-450e-448b-911d-b3c13d178dfc","title":"Linux Keylogging with Pam.d","author":"Pawel Mazur","status":"test","level":"high","date":"2021-05-24","modified":"2022-12-18","description":"Detect attempt to enable auditing of TTY input","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/T1056.001.md","https://linux.die.net/man/8/pam_tty_audit","https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sec-configuring_pam_for_auditing","https://access.redhat.com/articles/4409591#audit-record-types-2"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.collection","attack.credential-access","attack.t1003","attack.t1056.001"],"path":"rules/linux/auditd/lnx_auditd_keylogging_with_pam_d.yml","techniques":["T1003","T1056.001"],"cves":[]},{"id":"965e2db9-eddb-4cf6-a986-7a967df651e4","title":"Potential Keylogger Activity","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-01-04","modified":null,"description":"Detects PowerShell scripts that contains reference to keystroke capturing functions","references":["https://twitter.com/ScumBots/status/1610626724257046529","https://www.virustotal.com/gui/file/d4486b63512755316625230e0c9c81655093be93876e0d80732e7eeaf7d83476/content","https://www.virustotal.com/gui/file/720a7ee9f2178c70501d7e3f4bcc28a4f456e200486dbd401b25af6da3b4da62/content","https://learn.microsoft.com/en-us/dotnet/api/system.windows.input.keyboard.iskeydown?view=windowsdesktop-7.0"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.collection","attack.credential-access","attack.t1056.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_keylogger_activity.yml","techniques":["T1056.001"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2025-33053","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}