T1056.003 — Web Portal Capture

Tactics: Collection, Credential Access · Platforms: Linux, macOS, Windows

Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation…

Sub-technique of Input Capture (T1056).

Sigma detection rules (3)

title: "T1056.003 Input Capture: Web Portal Capture"
id: 23d519e0-6d29-408f-a0e5-7424f7abb545
description: 'Detection of credential harvesting via web portal modification, scoped to web-root/login-page directories and server-side script extensions. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: FilePath, ProcessName.'
references:
  - https://attack.mitre.org/techniques/T1056/003
author: Shahrukh Khan
date: 2026-02-27
license: MIT
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1056.003

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '11'
    TargetFilename|contains:
      - '\inetpub\wwwroot\'
      - '\inetpub\wwwroot\aspnet_client\'
      - '\Exchange Server\FrontEnd\HttpProxy\owa\'
      - '\Exchange Server\FrontEnd\HttpProxy\aspnet_client\'
      - '\ADFS\'
      - '\Citrix\'
      - '\wwwroot\'
    TargetFilename|endswith:
      - '.aspx'
      - '.asp'
      - '.php'
      - '.jsp'
      - '.js'
      - '.dll'
      - '.config'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate web application deployments, patches, or updates writing files into the same web-root directories; System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing routine maintenance are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

title: "T1056.003 Input Capture: Web Portal Capture"
id: bb3c04f6-92e2-4a89-986e-6a35d4c581aa
description: 'Detection of Credential Harvesting via Web Portal Modification. (Retargeted to file-integrity monitoring of the actual externally-facing web application/portal source and reverse-proxy configuration, rather than unrelated PAM authentication config, which is what the technique actually describes tampering with.) Tune using: MonitoredFilePaths, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1056/003
author: Shahrukh Khan
date: 2026-03-19
license: MIT
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1056.003

logsource:
  category: file_change
  product: linux

detection:
  selection_webroot:
    type: PATH
    name|contains:
      - '/var/www/'
      - '/usr/share/nginx/html/'
      - '/srv/http/'
  selection_proxyconf:
    type: PATH
    name|contains:
      - '/etc/nginx/sites-enabled/'
      - '/etc/nginx/conf.d/'
      - '/etc/httpd/conf.d/'
      - '/etc/apache2/sites-enabled/'
  selection_nametype:
    nametype:
      - NORMAL
      - CREATE
  filter_pkgmgr:
    exe|endswith:
      - '/dpkg'
      - '/rpm'
      - '/apt'
      - '/apt-get'
      - '/yum'
      - '/dnf'
  condition: (selection_webroot or selection_proxyconf) and selection_nametype and not filter_pkgmgr

falsepositives:
  - Legitimate application deployments (CI/CD pushes), package-manager-driven updates to default web pages, and admin edits to reverse-proxy configuration will also match; scope MonitoredFilePaths to the specific portal's login handler files for higher fidelity.

level: medium

title: "T1056.003 Input Capture: Web Portal Capture"
id: 8b1ee466-2376-4cb9-8b56-a5dadf7d3c58
description: 'Detection of Credential Harvesting via Web Portal Modification. (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: WebRootPath, AnomalousProcess.'
references:
  - https://attack.mitre.org/techniques/T1056/003
author: Shahrukh Khan
date: 2026-01-23
license: MIT
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1056.003

logsource:
  category: file_change
  product: macos

detection:
  selection:
    TargetFilename|contains:
      - '/Library/WebServer/Documents/'
      - '/usr/local/var/www/'
  condition: selection

falsepositives:
  - Normal web development or CMS updates to hosted content, since anomalous process attribution for the modifying process cannot be reliably distinguished from unified log file_change fields alone.

level: high

Related sub-techniques

• T1056.004 Credential API Hooking
• T1056.001 Keylogging
• T1056.002 GUI Input Capture

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1056.003 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan