Description
Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.(Citation: Talos Kimsuky Nov 2021)
Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes.(Citation: Adventures of a Keystroke) Some methods include:
Hooking API callbacks used for processing keystrokes. Unlike Credential API Hooking, this focuses solely on API functions intended for processing keystroke data. Reading raw keystroke data from the hardware buffer. Windows Registry modifications. Custom drivers. * Modify System Image may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.(Citation: Cisco Blog Legacy Device Attacks)
Platforms
Threat Groups (26)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.(Citation: FireEye APT38 O... |
| G0022 | APT3 | [APT3](https://attack.mitre.org/groups/G0022) has used a keylogging tool that records keystrokes in encrypted files.(Citation: Symantec Buckeye) |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes.(Citation... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has created and accessed a file named rult3uil.log on compromised domain controllers to capture ... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) used a keylogger called GEARSHIFT on a target system.(Citation: FireEye APT41 Aug 2019) |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) has used key loggers to steal usernames and passwords.(Citation: District Court of NY APT10 Indictme... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) has abused the PasswordChangeNotify to monitor for and capture account password changes.(Citation: Cybe... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034) has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.(Citation: ES... |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has used tools for capturing keystrokes.(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH A... |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has employed keyloggers including KEYPUNCH and LONGWATCH.(Citation: FireEye APT34 Webinar Dec 2017)(Ci... |
| G0004 | Ke3chang | [Ke3chang](https://attack.mitre.org/groups/G0004) has used keyloggers.(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December... |
| G0043 | Group5 | Malware used by [Group5](https://attack.mitre.org/groups/G0043) is capable of capturing keystrokes.(Citation: Citizen Lab Group5) |
| G0012 | Darkhotel | [Darkhotel](https://attack.mitre.org/groups/G0012) has used a keylogger.(Citation: Kaspersky Darkhotel) |
| G0007 | APT28 | [APT28](https://attack.mitre.org/groups/G0007) has used tools to perform keylogging.(Citation: Microsoft SIR Vol 19)(Citation: DOJ GRU Indictment Jul ... |
| G1044 | APT42 | [APT42](https://attack.mitre.org/groups/G1044) has used custom malware to log keystrokes.(Citation: Mandiant APT42-charms) |
| G1023 | APT5 | [APT5](https://attack.mitre.org/groups/G1023) has used malware with keylogging capabilities to monitor the communications of targeted entities.(Citati... |
| G0131 | Tonto Team | [Tonto Team](https://attack.mitre.org/groups/G0131) has used keylogging tools in their operations.(Citation: TrendMicro Tonto Team October 2020) |
| G0032 | Lazarus Group | [Lazarus Group](https://attack.mitre.org/groups/G0032) malware KiloAlfa contains keylogging functionality.(Citation: Novetta Blockbuster)(Citation: No... |
| G0085 | FIN4 | [FIN4](https://attack.mitre.org/groups/G0085) has captured credentials via fake Outlook Web App (OWA) login pages and has also used a .NET based keylo... |
| G0054 | Sowbug | [Sowbug](https://attack.mitre.org/groups/G0054) has used keylogging tools.(Citation: Symantec Sowbug Nov 2017) |
Associated Software (126)
| ID | Name | Type | Context |
|---|---|---|---|
| S0662 | RCSession | Malware | [RCSession](https://attack.mitre.org/software/S0662) has the ability to capture keystrokes on a compromised host.(Citation: Trend Micro DRBControl Feb... |
| S0248 | yty | Malware | [yty](https://attack.mitre.org/software/S0248) uses a keylogger plugin to gather keystrokes.(Citation: ASERT Donot March 2018) |
| S0213 | DOGCALL | Malware | [DOGCALL](https://attack.mitre.org/software/S0213) is capable of logging keystrokes.(Citation: FireEye APT37 Feb 2018)(Citation: Unit 42 Nokki Oct 201... |
| S1233 | PAKLOG | Malware | [PAKLOG](https://attack.mitre.org/software/S1233) has captured keystrokes using Windows API.(Citation: Zscaler PAKLOG CorkLog SplatCloak Splatdropper ... |
| S0330 | Zeus Panda | Malware | [Zeus Panda](https://attack.mitre.org/software/S0330) can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_... |
| S0167 | Matryoshka | Malware | [Matryoshka](https://attack.mitre.org/software/S0167) is capable of keylogging.(Citation: ClearSky Wilted Tulip July 2017)(Citation: CopyKittens Nov 2... |
| S1245 | InvisibleFerret | Malware | [InvisibleFerret](https://attack.mitre.org/software/S1245) has conducted keylogging using the Python project “pyWinHook” and "Pyhook".(Citation: Esent... |
| S1239 | TONESHELL | Malware | [TONESHELL](https://attack.mitre.org/software/S1239) has capabilities to conduct keylogging.(Citation: Palo Alto Unit42 STATELY TAURUS TONESHELL Septe... |
| S0088 | Kasidet | Malware | [Kasidet](https://attack.mitre.org/software/S0088) has the ability to initiate keylogging.(Citation: Zscaler Kasidet) |
| S0622 | AppleSeed | Malware | [AppleSeed](https://attack.mitre.org/software/S0622) can use <code>GetKeyState</code> and <code>GetKeyboardState</code> to capture keystrokes on the v... |
| S0198 | NETWIRE | Malware | [NETWIRE](https://attack.mitre.org/software/S0198) can perform keylogging.(Citation: McAfee Netwire Mar 2015)(Citation: FireEye APT33 Webinar Sept 201... |
| S1226 | BOOKWORM | Malware | [BOOKWORM](https://attack.mitre.org/software/S1226) has used its KBLogger.dll module to capture keystrokes and stored them in a folder. (Citation: Uni... |
| S0050 | CosmicDuke | Malware | [CosmicDuke](https://attack.mitre.org/software/S0050) uses a keylogger.(Citation: F-Secure The Dukes) |
| S0152 | EvilGrab | Malware | [EvilGrab](https://attack.mitre.org/software/S0152) has the capability to capture keystrokes.(Citation: PWC Cloud Hopper Technical Annex April 2017) |
| S0058 | SslMM | Malware | [SslMM](https://attack.mitre.org/software/S0058) creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators.(Citation... |
| S0342 | GreyEnergy | Malware | [GreyEnergy](https://attack.mitre.org/software/S0342) has a module to harvest pressed keystrokes.(Citation: ESET GreyEnergy Oct 2018) |
| S0115 | Crimson | Malware | [Crimson](https://attack.mitre.org/software/S0115) can use a module to perform keylogging on compromised hosts.(Citation: Proofpoint Operation Transpa... |
| S1159 | DUSTTRAP | Malware | [DUSTTRAP](https://attack.mitre.org/software/S1159) can perform keylogging operations.(Citation: Google Cloud APT41 2024) |
| S0409 | Machete | Malware | [Machete](https://attack.mitre.org/software/S0409) logs keystrokes from the victim’s machine.(Citation: ESET Machete July 2019)(Citation: Securelist M... |
| S1012 | PowerLess | Malware | [PowerLess](https://attack.mitre.org/software/S1012) can use a module to log keystrokes.(Citation: Cybereason PowerLess February 2022) |
References
- An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.
- Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.
- Tinaztepe, E. (n.d.). The Adventures of a Keystroke: An in-depth look into keyloggers on Windows. Retrieved April 27, 2016.
Frequently Asked Questions
What is T1056.001 (Keylogging)?
T1056.001 is a MITRE ATT&CK technique named 'Keylogging'. It belongs to the Collection, Credential Access tactic(s). Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when [OS Credential Dumping](ht...
How can T1056.001 be detected?
Detection of T1056.001 (Keylogging) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1056.001?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1056.001?
Known threat groups using T1056.001 include: APT38, APT3, Kimsuky, Volt Typhoon, APT41, menuPass, APT32, Sandworm Team.