|T1056.002||GUI Input Capture|
|T1056.003||Web Portal Capture|
|T1056.004||Credential API Hooking|
Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured.
Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes. Some methods include:
ADVSTORESHELL can perform keylogging.
Agent Tesla can log keystrokes on the victim’s machine.
|G0130||Ajax Security Team||
Ajax Security Team has used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system.
AppleSeed can use
APT3 has used a keylogging tool that records keystrokes in encrypted files.
APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes.
APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.
APT41 used a keylogger called GEARSHIFT on a target system.
One of Attor's plugins can collect user credentials via capturing keystrokes and can capture keystrokes pressed within the window of the injected process.
BabyShark has a PowerShell-based remote administration ability that can implement a PowerShell or C# based keylogger.
When it first starts, BADNEWS spawns a new thread to log keystrokes.
BlackEnergy has run a keylogger plug-in on a victim.
Cadelspy has the ability to log keystrokes on the compromised host.
Carbanak logs key strokes for configured processes and sends them back to the C2 server.
Cardinal RAT can log keystrokes.
Catchamas collects keystrokes from the victim’s machine.
Clambling can capture keystrokes on a compromised host.
Cobalt Strike can track key presses with a keylogger module.
Cobian RAT has a feature to perform keylogging on the victim’s machine.
CosmicDuke uses a keylogger.
Crimson can use a module to perform keylogging on compromised hosts.
Cuba logs keystrokes via polling by using
DarkTortilla can download a keylogging module.
DarkWatchman can track key presses with a keylogger module.
ECCENTRICBANDWAGON can capture and store keystrokes.
Empire includes keylogging capabilities for Windows, Linux, and macOS systems.
Explosive has leveraged its keylogging capabilities to gain access to administrator accounts on target servers.
FIN4 has captured credentials via fake Outlook Web App (OWA) login pages and has also used a .NET based keylogger.
FlawedAmmyy can collect keyboard events.
The FunnyDream Keyrecord component can capture keystrokes.
Grandoreiro can log keystrokes on the victim's machine.
GreyEnergy has a module to harvest pressed keystrokes.
Malware used by Group5 is capable of capturing keystrokes.
The executable version of Helminth has a module to log keystrokes.
HEXANE has used a PowerShell-based keylogger named
HTTPBrowser is capable of capturing keystrokes on victims.
Imminent Monitor has a keylogging module.
InvisiMole can capture keystrokes on a compromised host.
jRAT has the capability to log keystrokes from the victim’s machine, both offline and online.
KeyBoy installs a keylogger for intercepting credentials and keystrokes.
KGH_SPY can perform keylogging by polling the
Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes.
Kivars has the ability to initiate keylogging on the infected host.
Lazarus Group malware KiloAlfa contains keylogging functionality.
Lokibot has the ability to capture input on the compromised host via keylogging.
Machete logs keystrokes from the victim’s machine.
MacMa can use Core Graphics Event Taps to intercept user keystrokes from any text input field and saves them to text files. Text input fields include Spotlight, Finder, Safari, Mail, Messages, and other apps that have text fields for passwords.
Magic Hound malware is capable of keylogging.
MarkiRAT can capture all keystrokes on a compromised host.
Matryoshka is capable of keylogging.
menuPass has used key loggers to steal usernames and passwords.
Metamorfo has a command to launch a keylogger and capture keystrokes on the victim’s machine.
NanoCore can perform keylogging on the victim’s machine.
NetTraveler contains a keylogger.
OilRig has used keylogging tools called KEYPUNCH and LONGWATCH.
Okrum was seen using a keylogger tool to capture keystrokes. 
During Operation Wocao, threat actors obtained the password for the victim's password manager via a custom keylogger.
OwaAuth captures and DES-encrypts credentials before writing the username and password to a log file,
PlugX has a module for capturing keystrokes per process including window titles.
PoetRAT has used a Python tool named klog.exe for keylogging.
PoshC2 has modules for keystroke logging and capturing credentials from spoofed Outlook authentication messages.
Prikormka contains a keylogger module that collects keystrokes and the titles of foreground windows.
Pupy uses a keylogger to capture keystrokes it then sends back to the server after it is stopped.
QakBot can capture keystrokes on a compromised host.
RCSession has the ability to capture keystrokes on a compromised host.
Remexi gathers and exfiltrates keystrokes from the machine.
Revenge RAT has a plugin for keylogging.
ROKRAT can use
RTM can record keystrokes from both the keyboard and virtual keyboard.
RunningRAT captures keystrokes and sends them back to the C2 server.
Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.
SILENTTRINITY has a keylogging capability.
SLOTHFULMEDIA has a keylogging capability.
SslMM creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators.
Sykipot contains keylogging functionality to steal passwords.
TajMahal has the ability to capture keystrokes on an infected host.
ThiefQuest uses the
Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.
Tonto Team has used keylogging tools in their operations.
Trojan.Karagany can capture keystrokes on a compromised host.
Unknown Logger is capable of recording keystrokes.
WarzoneRAT has the capability to install a live and offline keylogger, including through the use of the
XAgentOSX contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure.
Zeus Panda can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_KEYDOWN.
ZxShell has a feature to capture a remote computer's keystrokes using a keylogger.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
|ID||Data Source||Data Component||Detects|
Monitor for unusual kernel driver installation activity
|DS0009||Process||OS API Execution||
Monitor for API calls to the SetWindowsHook, GetKeyState, and GetAsyncKeyState. and look for common keylogging API calls. API calls alone are not an indicator of keylogging, but may provide behavioral data that is useful when combined with other information such as new files written to disk and unusual processes.
|DS0024||Windows Registry||Windows Registry Key Modification||
Monitor for changes made to windows registry keys or values for unexpected modifications