| ID | Name |
|---|---|
| T1056.001 | Keylogging |
| T1056.002 | GUI Input Capture |
| T1056.003 | Web Portal Capture |
| T1056.004 | Credential API Hooking |
Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service.
This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.[1]
| ID | Name | Description |
|---|---|---|
| C0029 | Cutting Edge |
During Cutting Edge, threat actors modified the JavaScript loaded by the Ivanti Connect Secure login page to capture credentials entered.[2] |
| S1022 | IceApple |
The IceApple OWA credential logger can monitor for OWA authentication requests and log the credentials.[3] |
| C0030 | Triton Safety Instrumented System Attack |
In the Triton Safety Instrumented System Attack, TEMP.Veles captured credentials as they were being changed by redirecting text-based login codes to websites they controlled.[4] |
| S1116 | WARPWIRE |
WARPWIRE can capture credentials submitted during the web logon process in order to access layer seven applications such as RDP.[5] |
| G1035 | Winter Vivern |
Winter Vivern registered and hosted domains to allow for creation of web pages mimicking legitimate government email logon sites to collect logon information.[6] |
| ID | Mitigation | Description |
|---|---|---|
| M1026 | Privileged Account Management |
Do not allow administrator accounts that have permissions to modify the Web content of organization login portals to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0022 | File | File Modification |
Monitor for changes made to detect changes to files in the Web directory for organization login pages that do not match with authorized updates to the Web server's content. |