T1056.001 — Keylogging

Tactics: Collection, Credential Access · Platforms: Linux, macOS, Network Devices, Windows

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a…

Sub-technique of Input Capture (T1056).

Sigma detection rules (4)

T1056.001 Input Capture: Keylogging

title: "T1056.001 Input Capture: Keylogging"
id: ea8446be-3067-4971-90bb-2574ee2dfa8c
description: 'Proxies user-mode keylogging detection via memory-read access to interactive-input-pipeline processes (explorer.exe, csrss.exe, winlogon.exe). (Data Component: Process Access; baseline tier: windows-eventid.) Tune using: TargetImage, AccessMask, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1056/001
author: Shahrukh Khan
date: 2026-05-29
license: MIT
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1056.001

logsource:
  category: process_access
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '10'
    TargetImage|endswith:
      - '\explorer.exe'
      - '\csrss.exe'
      - '\winlogon.exe'
    GrantedAccess:
      - '0x1410'
      - '0x1010'
      - '0x1038'
      - '0x1fffff'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter_system_account

falsepositives:
  - Security/EDR agents and accessibility software.

level: medium

T1056.001 Input Capture: Keylogging

title: "T1056.001 Input Capture: Keylogging"
id: 614d3e5c-6f66-4bc8-9033-1897f4b8c328
description: 'Behavioral Detection of Keylogging Activity Across Platforms. (Retargeted to the file_event auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ProcessName, DevicePath.'
references:
  - https://attack.mitre.org/techniques/T1056/001
author: Shahrukh Khan
date: 2026-06-04
license: MIT
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1056.001

logsource:
  category: file_event
  product: linux

detection:
  selection:
    type: PATH
    name|startswith: '/dev/input/'
  filter:
    exe|endswith:
      - '/Xorg'
      - '/Xwayland'
  condition: selection and not filter

falsepositives:
  - Legitimate window-system input daemons are excluded via the filter, but other legitimate accessibility or remote-desktop software (e.g., x11vnc capturing input) may still trigger.

level: medium

T1056.001 Input Capture: Keylogging

title: "T1056.001 Input Capture: Keylogging"
id: 5f06eddc-facf-418c-bf24-34204ac79bef
description: 'Behavioral Detection of Keylogging Activity Across Platforms. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: Service, ExecutablePath.'
references:
  - https://attack.mitre.org/techniques/T1056/001
author: Shahrukh Khan
date: 2026-03-31
license: MIT
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1056.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/python3'
      - '/osascript'
  selection_tcc:
    CommandLine|contains: 'tccutil reset Accessibility'
  condition: selection and selection_tcc

falsepositives:
  - IT staff resetting Accessibility or Input Monitoring permissions for troubleshooting purposes, since raw keystroke capture via the Quartz Event Services API is invisible to unified log process events.

level: high

T1056.001 Input Capture: Keylogging

title: "T1056.001 Input Capture: Keylogging"
id: 574020bb-aa61-4a23-b850-38fdfe9e3d6b
description: 'Behavioral Detection of Keylogging Activity Across Platforms. (Data Component: Firmware Modification; baseline tier: fallback.) Tune using: FirmwareVersion, Protocol.'
references:
  - https://attack.mitre.org/techniques/T1056/001
author: Shahrukh Khan
date: 2026-04-04
license: MIT
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1056.001

logsource:
  product: networkdevice
  service: syslog

detection:
  selection_firmware:
    Message|contains:
      - 'image verification failed'
      - 'unexpected image'
  selection_protocol:
    Message|contains:
      - 'telnet'
      - 'unencrypted'
  condition: selection_firmware or selection_protocol

falsepositives:
  - An intentional temporary rollback to an older firmware version for compatibility testing during a maintenance window will also match.

level: high

Related sub-techniques

Explore