T1056.002 · threatengine.sh

Home/ATT&CK Technique/GUI Input Capture

ATT&CK Technique

GUI Input Capture

T1056.002 · collection, credential-access

Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control). Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.

This type of prompt can be used to collect credentials via various languages such as AppleScript and PowerShell. On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line (i.e. Unix Shell).

Adversaries may also mimic common software authentication requests, such as those from browsers or email clients. This may also be paired with user activity monitoring (i.e., Browser Information Discovery and/or Application Window Discovery) to spoof prompts when users are naturally accessing sensitive sites/data.

LinuxmacOSWindows

◆

Actors Using This

14

latin_america_brazilian_organized_cybercrimeAmavaldo
brazilBanbra
brazilBizarro
latin_america_brazilian_organized_cybercrimeCasbaneiro / Metamorfo
latin_america_brazilian_organized_cybercrimeGrandoreiro
latin_america_brazilian_organized_cybercrimeGuildma / Astaroth
latin_america_brazilian_organized_cybercrimeJavali
brazilKrachulka
brazilLokorrito
latin_america_brazilian_organized_cybercrimeMekotio
latin_america_brazilian_organized_cybercrimeMelcoz
latin_america_brazilian_organized_cybercrimeMispadu / URSA
latin_america_brazilian_organized_cybercrimeNumando
latin_america_brazilian_organized_cybercrimeOusaban

◈

Likely Attack Path

Techniques the same actors pair with this one distinctively - those showing up among actors who use this technique noticeably more than across all actors (lift > 1.15), grouped by kill-chain phase. The × is that lift multiplier; the shared-actor count is in the tooltip. A near-universal technique pairs with everything at baseline, so its list is short by design.

persistence earlier

T1037.001 · Logon Script (Windows) ×8.93 T1037 · Boot or Logon Initialization Scripts ×2.52

privilege-escalation earlier

T1055.012 · Process Hollowing ×8.37

credential-access same

T1539 · Steal Web Session Cookie ×3.66

discovery later

T1614.001 · System Language Discovery ×8.93 T1497.003 · Time Based Checks ×2.59

collection later

T1185 · Browser Session Hijacking ×10.62 T1056.004 · Credential API Hooking ×8.26 T1115 · Clipboard Data ×2.70

exfiltration later

T1020 · Automated Exfiltration ×2.68

impact later

T1499 · Endpoint Denial of Service ×5.11 T1565.002 · Transmitted Data Manipulation ×4.13 T1565.001 · Stored Data Manipulation ×3.10

other same

T1218.007 · Msiexec ×8.01 T1036.001 · Invalid Code Signature ×4.25

▸

Atomic Tests

3

Executable Atomic Red Team test cases for exercising this technique in a lab. Copy a command, run it on the listed platform, confirm your detections fire.

bashmacosAppleScript - Prompt User for Password

Prompt User for Password (Local Phishing) Reference: http://fuzzynop.blogspot.com/2014/10/osascript-for-local-phishing.html

osascript -e 'tell app "System Preferences" to activate' -e 'tell app "System Preferences" to activate' -e 'tell app "System Preferences" to display dialog "Software Update requires that you type your password to apply changes." & return & return  default answer "" with icon 1 with hidden answer with title "Software Update"'

powershellwindowsPowerShell - Prompt User for Password

Prompt User for Password (Local Phishing) as seen in Stitch RAT. Upon execution, a window will appear for the user to enter their credentials. Reference: https://github.com/nathanlopez/Stitch/blob/master/PyLib/askpass.py

# Creates GUI to prompt for password. Expect long pause before prompt is available.    
$cred = $host.UI.PromptForCredential('Windows Security Update', '',[Environment]::UserName, [Environment]::UserDomainName)
# Using write-warning to allow message to show on console as echo and other similar commands are not visable from the Invoke-AtomicTest framework.
write-warning $cred.GetNetworkCredential().Password

bashmacosAppleScript - Spoofing a credential prompt using osascript

Prompt user for password without requiring permissions to send Apple events to System Settings. https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/

PWD_SPOOF=$(osascript -e 'display dialog "To perform a security update MacOS needs your passphrase." with title "MacOS Security Update" default answer "" with icon stop with hidden answer')
echo $PWD_SPOOF

▣

Mitigations

1

MITRE ATT&CK mitigations - vendor-agnostic guidance for reducing exposure to this technique.

M1017User Training

User Training involves educating employees and contractors on recognizing, reporting, and preventing cyber threats that rely on human interaction, such as phishing, social engineering, and other manipulative techniques. Comprehensive training programs create a human firewall by empowering users to be an active component of the organization's cybersecurity defenses.

Create Comprehensive Training Programs

Design training modules tailored to the organization's risk profile, covering topics such as phishing, password management, and incident reporting.
Provide role-specific training for high-risk employees, such as helpdesk staff or executives.

Use Simulated Exercises

Conduct phishing simulations to measure user susceptibility and provide targeted follow-up training.
Run social engineering drills to evaluate employee responses and reinforce protocols.

Leverage Gamification and Engagement

Introduce interactive learning methods such as quizzes, gamified challenges, and rewards for successful detection and reporting of threats.

Incorporate Security Policies into Onboarding

Include cybersecurity training as part of the onboarding process for new employees.
Provide easy-to-understand materials outlining acceptable use policies and reporting procedures.

Regular Refresher Courses

Update training materials to include emerging threats and techniques used by adversaries.
Ensure all employees complete periodic refresher courses to stay informed.

Emphasize Real-World Scenarios

Use case studies of recent attacks to demonstrate the consequences of successful phishing or social engineering.
Discuss how specific employee actions can prevent or mitigate such attacks.

◈

Detection Coverage

1/6 layers

Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).

Behavioral / log (Sigma) 3

Analytics (MITRE CAR) none

Runtime / container (Falco) none

File / malware (YARA) none

Network (Suricata/Snort) none

Vuln scan (Nuclei) none

▣

Comply & Defend

NIST 800-53CA-07, SI-03, SI-04, SI-07

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

MITRE ATT&CK Atomic Red Team car (MITRE)

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin