Techniques › T1056 › T1056.001
T1056.001 Keylogging
collection · credential access — Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
4
analytics
3
Sigma rules tagged attack.t1056.001
1
KEV CVEs mapped here
<p>Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.</p><p>Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes. Some methods include:</p>
- <li>Hooking API callbacks used for processing keystrokes. Unlike Credential API Hooking, this focuses solely on API functions intended for processing keystroke data.</li><li>Reading raw keystroke data from the hardware buffer.</li><li>Windows Registry modifications.</li><li>Custom drivers.</li><li>Modify System Image may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.</li>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-33053 | Microsoft Windows | secondary impact | Mapped | 2025-06-10 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0089 Behavioral Detection of Keylogging Activity Across Platforms v1.0
AN0243 WindowsMonitors suspicious usage of Windows API calls like SetWindowsHookEx, GetKeyState, or polling functions within non-UI service processes, combined with Registry or driver modifications.Tunable:
TargetImageAccessMaskTimeWindowAN0244 LinuxDetects non-system processes accessing /dev/input/* or issuing ptrace/evdev syscalls used for reading keystroke buffers directly.Tunable:ProcessNameDevicePathAN0245 macOSDetects unauthorized TCC access or use of Quartz Event Services (CGEventTapCreate) or IOHID for event tap installation within unexpected processes.Tunable:ServiceExecutablePathAN0246 Network DevicesKeylogging on legacy network devices via unauthorized system image modification or remote capture of console keystrokes (telnet, SSH) through altered firmware or man-in-the-middle key sniffing.Tunable:FirmwareVersionProtocol
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1056.001
Author: frack113
· 2021-07-30 (modified 2022-07-11) · logsource: product=windows category=ps_script · 34f90d3c-c297-49e9-b26d-911b05a4866c
Adversaries may log user keystrokes to intercept credentials as the user types them.
Author: Pawel Mazur
· 2021-05-24 (modified 2022-12-18) · logsource: product=linux service=auditd · 49aae26c-450e-448b-911d-b3c13d178dfc
Detect attempt to enable auditing of TTY input
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-04 · logsource: product=windows category=ps_script · 965e2db9-eddb-4cf6-a986-7a967df651e4
Detects PowerShell scripts that contains reference to keystroke capturing functions
Rules tagged at the parent level (attack.t1056) 2
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Josh Nickels
· 2024-02-26 · logsource: product=windows category=dns_query · df68f791-ad95-447f-a271-640a0dab9cf8
Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application.
When the OneLaunch application is installed it will attempt to get updates from this domain.
Author: Gavin Knapp
· 2023-03-16 · logsource: category=proxy · eb6c2004-1cef-427f-8885-9042974e5eb6
Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.