T1056.002 — GUI Input Capture

Tactics: Collection, Credential Access · Platforms: Linux, macOS, Windows

Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for…

Sub-technique of Input Capture (T1056).

Sigma detection rules (3)

T1056.002 Input Capture: GUI Input Capture

title: "T1056.002 Input Capture: GUI Input Capture"
id: 3af48221-cab5-4edc-8380-36b341e7011f
description: 'Detects processes invoking Windows credential-prompt APIs/cmdlets (CredUIPromptForCredentials, PromptForCredential, Get-Credential) or a consent.exe-named process running from a non-standard path, proxies for a spoofed UAC-style credential prompt (the previous version matched GetAsyncKeyState/SetWindowsHookEx, which is API-based keystroke logging, T1056.001, not a fake GUI prompt). Tune using: CommandLine, ParentProcessName, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1056/002
author: Shahrukh Khan
date: 2026-02-07
license: MIT
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1056.002

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_fake_prompt:
    CommandLine|contains:
      - 'CredUIPromptForCredentials'
      - 'PromptForCredential'
      - 'Get-Credential'
  selection_consent_masquerade:
    Image|endswith: '\consent.exe'
  filter_consent_legit:
    Image|startswith: 'C:\Windows\System32\'

  condition: selection_fake_prompt or (selection_consent_masquerade and not filter_consent_legit)

falsepositives:
  - Legitimate PowerShell scripts or installers using Get-Credential or CredUIPromptForCredentials for authorized interactive authentication; validate the calling process against known-good software inventories.

level: high

T1056.002 Input Capture: GUI Input Capture

title: "T1056.002 Input Capture: GUI Input Capture"
id: b6296142-189d-431c-9bab-8dbf385222ab
description: 'Behavioral Detection of Spoofed GUI Credential Prompts. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Now requires a0 to be a known Linux GUI dialog binary (zenity, kdialog, Xdialog, whiptail, dialog) in combination with a credential-prompt string appearing anywhere in its arguments, rather than matching the prompt string against any process argv regardless of binary. Tune using: ExecutableName, PromptString.'
references:
  - https://attack.mitre.org/techniques/T1056/002
author: Shahrukh Khan
date: 2026-03-07
license: MIT
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1056.002

logsource:
  category: process_creation
  product: linux

detection:
  selection_tool:
    type: EXECVE
    a0|endswith:
      - '/zenity'
      - '/kdialog'
      - '/Xdialog'
      - '/whiptail'
      - '/dialog'
  selection_prompt:
    - type: EXECVE
      a1|contains:
        - 'Password:'
        - '[sudo] password'
        - 'password'
    - type: EXECVE
      a2|contains:
        - 'Password:'
        - '[sudo] password'
        - 'password'
    - type: EXECVE
      a3|contains:
        - 'Password:'
        - '[sudo] password'
        - 'password'
  condition: selection_tool and selection_prompt

falsepositives:
  - Legitimate sysadmin scripts and installers that use zenity/kdialog/whiptail to prompt for a password for a genuine reason (e.g. a wrapper around sudo, disk-encryption unlock prompts); scope PromptString/ExecutableName tuning to known-good wrapper scripts.

level: medium

T1056.002 Input Capture: GUI Input Capture

title: "T1056.002 Input Capture: GUI Input Capture"
id: 666613d8-e521-4a8b-89b5-44c3c9210c18
description: 'Behavioral Detection of Spoofed GUI Credential Prompts. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScriptContent, ProcessPath.'
references:
  - https://attack.mitre.org/techniques/T1056/002
author: Shahrukh Khan
date: 2026-02-09
license: MIT
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1056.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/osascript'
    CommandLine|contains|all:
      - 'display dialog'
      - 'default answer'
      - 'with hidden answer'
  condition: selection

falsepositives:
  - Legitimate internal helper tools that prompt users for confirmation using a hidden text field for non-credential purposes.

level: high

Related sub-techniques

Explore