t1056-002-gui-input-capture

name	T1056.002_gui-input-capture
description	Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt.
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1056.002","collection","credential-access","macos","windows","linux","sub-technique"]
technique_id	T1056.002
tactic	collection
all_tactics	["collection","credential-access"]
platforms	["macOS","Windows","Linux"]
mitre_url	https://attack.mitre.org/techniques/T1056/002
tech_stack	["macos","windows","linux"]
cwe_ids	["CWE-200"]
chains_with	["T1056","T1056.001","T1056.003","T1056.004"]
prerequisites	["T1056"]
severity_boost	{"T1056":"Chain with T1056 for deeper attack path","T1056.001":"Chain with T1056.001 for deeper attack path","T1056.003":"Chain with T1056.003 for deeper attack path"}

T1056.002 GUI Input Capture

Sub-technique of: T1056

High-Level Description

Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control).

Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite. This type of prompt can be used to collect credentials via various languages such as AppleScript and PowerShell. On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. Unix Shell).

Adversaries may also mimic common software authentication requests, such as those from browsers or email clients. This may also be paired with user activity monitoring (i.e., Browser Information Discovery and/or Application Window Discovery) to spoof prompts when users are naturally accessing sensitive sites/data.

Kill Chain Phase

• Collection (TA0009)
• Credential Access (TA0006)

Platforms: macOS, Windows, Linux

What to Check

• Identify if GUI Input Capture technique is applicable to target environment
• Check macOS systems for indicators of GUI Input Capture
• Check Windows systems for indicators of GUI Input Capture
• Check Linux systems for indicators of GUI Input Capture
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: AppleScript - Prompt User for Password

Prompt User for Password (Local Phishing) Reference: http://fuzzynop.blogspot.com/2014/10/osascript-for-local-phishing.html