用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t1056-001-keylogging命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
正在显示 SKILL.md
| name | T1056.001_keylogging |
| description | Adversaries may log user keystrokes to intercept credentials as the user types them. |
| category | information-gathering |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1056.001","collection","credential-access","linux","macos","network-devices","windows","sub-technique"] |
| technique_id | T1056.001 |
| tactic | collection |
| all_tactics | ["collection","credential-access"] |
| platforms | ["Linux","macOS","Network Devices","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1056/001 |
| tech_stack | ["linux","macos","network devices","windows"] |
| cwe_ids | ["CWE-200"] |
| chains_with | ["T1056","T1056.002","T1056.003","T1056.004"] |
| prerequisites | ["T1056"] |
| severity_boost | {"T1056":"Chain with T1056 for deeper attack path","T1056.002":"Chain with T1056.002 for deeper attack path","T1056.003":"Chain with T1056.003 for deeper attack path"} |
Sub-technique of: T1056
Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.
Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes. Some methods include:
Platforms: Linux, macOS, Network Devices, Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Utilize PowerShell and external resource to capture keystrokes Payload Provided by PowerSploit
Upon successful execution, Powershell will execute and output to key.log.
Get-Keystrokes.ps1Supported Platforms: windows Elevation Required: Yes
&"$PathToAtomicsFolder\T1056.001\src\Get-Keystrokes.ps1" -LogPath #{filepath}
Dependencies:
Pluggable Access Module, which is present on all modern Linux systems, generally contains a library called pam_tty_audit.so which logs all keystrokes for the selected users and sends it to audit.log. All terminal activity on any new logins would then be archived and readable by an adversary with elevated privledges.
Passwords hidden by the console can also be logged, with 'log_passwd' as in this example. If root logging is enabled, then output from any process which is later started by root is also logged, even if this policy is carefully enabled (e.g. 'disable=*' as the initial command).
Use 'aureport --tty' or other audit.d reading tools to read the log output, which is binary. Mac OS does not currently contain the pam_tty_audit.so library.
Supported Platforms: linux Elevation Required: Yes
if sudo test -f /etc/pam.d/password-auth; then sudo cp /etc/pam.d/password-auth /tmp/password-auth.bk; fi;
if sudo test -f /etc/pam.d/system-auth; then sudo cp /etc/pam.d/system-auth /tmp/system-auth.bk; fi;
sudo touch /tmp/password-auth.bk
sudo touch /tmp/system-auth.bk sudo echo "session required pam_tty_audit.so
enable=* log_password" >> /etc/pam.d/password-auth sudo echo "session required pam_tty_audit.so
enable=* log_password" >> /etc/pam.d/system-auth
Dependencies:
There are several variables that can be set to control the appearance of the bash command prompt: PS1, PS2, PS3, PS4 and PROMPT_COMMAND. The contents of these variables are executed as if they had been typed on the command line. The PROMPT_COMMAND variable "if set" will be executed before the PS1 variable and can be configured to write the latest "bash history" entries to the syslog.
To gain persistence the command could be added to the users .bashrc or .bash_aliases or the systems default .bashrc in /etc/skel/
Supported Platforms: linux Elevation Required: Yes
PROMPT_COMMAND='history -a >(tee -a ~/.bash_history |logger -t "$USER[$$] $SSH_CONNECTION ")'
echo "\$PROMPT_COMMAND=$PROMPT_COMMAND"
tail /var/log/syslog
Dependencies:
There are several variables that can be set to control the appearance of the bash command prompt: PS1, PS2, PS3, PS4 and PROMPT_COMMAND. The contents of these variables are executed as if they had been typed on the command line. The PROMPT_COMMAND variable "if set" will be executed before the PS1 variable and can be configured to write the latest "bash history" entries to the syslog.
To gain persistence the command could be added to the users .shrc or .profile
Supported Platforms: linux Elevation Required: Yes
PS2=`logger -t "$USER" -f ~/.sh_history`
$PS2
tail /var/log/messages
Dependencies:
When a command is executed in bash, the BASH_COMMAND variable contains that command. For example :~$ echo $BASH_COMMAND = "echo $BASH_COMMAND". The trap command is not a external command, but a built-in function of bash and can be used in a script to run a bash function when some event occurs. trap will detect when the BASH_COMMAND variable value changes and then pipe that value into a file, creating a bash session based keylogger.
To gain persistence the command could be added to the users .bashrc or .bash_aliases or the systems default .bashrc in /etc/skel/
Supported Platforms: linux
trap 'echo "$(date +"%d/%m/%y %H:%M:%S.%s") $USER $BASH_COMMAND" >> #{output_file}' DEBUG
echo "Hello World!"
cat #{output_file}
Dependencies:
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Keylogging by examining the target platforms (Linux, macOS, Network Devices).
Assess Existing Defenses: Review whether mitigations for T1056.001 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
No specific mitigations documented for this technique.
| Finding | Severity | Impact |
|---|---|---|
| Keylogging technique applicable | High | Collection |
| CWE ID | Title |
|---|---|
| CWE-200 | Exposure of Sensitive Information |