kevmap

Techniques › T1056 › T1056.002

T1056.002 GUI Input Capture

collection · credential access — Linux, macOS, Windows · attack.mitre.org · JSON

1
MITRE detection strategy
3
analytics
3
Sigma rules tagged attack.t1056.002
0
KEV CVEs mapped here
<p>Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control).</p><p>Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite. This type of prompt can be used to collect credentials via various languages such as AppleScript and PowerShell. On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. Unix Shell).</p><p>Adversaries may also mimic common software authentication requests, such as those from browsers or email clients. This may also be paired with user activity monitoring (i.e., Browser Information Discovery and/or Application Window Discovery) to spoof prompts when users are naturally accessing sensitive sites/data.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1056.002

GUI Input Capture - macOS lowtest
Author: remotephone, oscd.community · 2020-10-13 (modified 2025-12-05) · logsource: product=macos category=process_creation · 60f1ce20-484e-41bd-85f4-ac4afec2c541
Detects attempts to use system dialog prompts to capture user credentials
Techniques: T1056.002
CredUI.DLL Loaded By Uncommon Process mediumtest
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · 2020-10-20 (modified 2026-06-29) · logsource: product=windows category=image_load · 9ae01559-cf7e-4f8e-8e14-4c290a1b4784
Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".
Techniques: T1056.002
PUA - Mouse Lock Execution mediumtest
Author: Cian Heasley · 2020-08-13 (modified 2023-02-21) · logsource: product=windows category=process_creation · c9192ad9-75e5-43eb-8647-82a0a5b493e3
In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.
Techniques: T1056.002

Rules tagged at the parent level (attack.t1056) 2

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

DNS Query Request To OneLaunch Update Service lowtest
Author: Josh Nickels · 2024-02-26 · logsource: product=windows category=dns_query · df68f791-ad95-447f-a271-640a0dab9cf8
Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain.
Techniques: T1056
Suspicious Network Communication With IPFS lowtest
Author: Gavin Knapp · 2023-03-16 · logsource: category=proxy · eb6c2004-1cef-427f-8885-9042974e5eb6
Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.
Techniques: T1056