Input Capture
Sub-techniques (4)
Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).
Procedure Examples |
|
| Name | Description |
|---|---|
| metaMain |
metaMain can log mouse events.(Citation: SentinelLabs Metador Technical Appendix Sept 2022) |
| Mafalda |
Mafalda can conduct mouse event logging.(Citation: SentinelLabs Metador Technical Appendix Sept 2022) |
|
Versa Director Zero Day Exploitation intercepted and harvested credentials from user logins to compromised devices.(Citation: Lumen Versa 2024) |
|
| Chaes |
Chaes has a module to perform any API hooking it desires.(Citation: Cybereason Chaes Nov 2020) |
| FlawedAmmyy |
FlawedAmmyy can collect mouse events.(Citation: Korean FSI TA505 2020) |
| Kobalos |
Kobalos has used a compromised SSH client to capture the hostname, port, username and password used to establish an SSH connection from the compromised host.(Citation: ESET Kobalos Feb 2021)(Citation: ESET Kobalos Jan 2021) |
| NPPSPY |
NPPSPY captures user input into the Winlogon process by redirecting RPC traffic from legitimate listening DLLs within the operating system to a newly registered malicious item that allows for recording logon information in cleartext.(Citation: Huntress NPPSPY 2022) |
| APT39 |
APT39 has utilized tools to capture mouse movements.(Citation: FBI FLASH APT39 September 2020) |
Detection
Detection may vary depending on how input is captured but may include monitoring for certain Windows API calls (e.g. `SetWindowsHook`, `GetKeyState`, and `GetAsyncKeyState`)(Citation: Adventures of a Keystroke), monitoring for malicious instances of Command and Scripting Interpreter, and ensuring no unauthorized drivers or kernel modules that could indicate keylogging or API hooking are present.
References
- Tinaztepe, E. (n.d.). The Adventures of a Keystroke: An in-depth look into keyloggers on Windows. Retrieved April 27, 2016.
- SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.
- Black Lotus Labs. (2024, August 27). Taking The Crossroads: The Versa Director Zero-Day Exploitaiton. Retrieved August 27, 2024.
- Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021.
- Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.
- M.Leveille, M., Sanmillan, I. (2021, January). A WILD KOBALOS APPEARS Tricksy Linux malware goes after HPCs. Retrieved August 24, 2021.
- M.Leveille, M., Sanmillan, I. (2021, February 2). Kobalos – A complex Linux threat to high performance computing infrastructure. Retrieved August 24, 2021.
- Dray Agha. (2022, August 16). Cleartext Shenanigans: Gifting User Passwords to Adversaries With NPPSPY. Retrieved May 17, 2024.
- FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020.
Связанные риски
Каталоги
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.