Detection of Input Capture

Technique Detected:  Input Capture | T1417

ID: DET0705
Domains: Mobile
Analytics: AN1825, AN1826
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1825

The user can view and manage installed third-party keyboards.
Application vetting services can look for applications requesting the permissions granting access to accessibility services or application overlay.

Log Sources
Data Component Name Channel
System Settings (DC0118) User Interface None
Permissions Requests (DC0114) Application Vetting None

AN1826

The user can view and manage installed third-party keyboards.
Application vetting services can look for applications requesting the permissions granting access to accessibility services or application overlay.

Log Sources
Data Component Name Channel
System Settings (DC0118) User Interface None
Permissions Requests (DC0114) Application Vetting None