sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
WhisperGate has the ability to inject its fourth stage into a suspended process created by the legitimate Windows utility `InstallUtil.exe`.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Woody RAT can create a suspended notepad process and write shellcode to delete a file into the suspended process using `NtWriteVirtualMemory`.
Technique: T1055.012 Process Injection: Process Hollowing, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Leafminer has used Process Doppelgänging to evade security software while deploying tools on compromised systems.
Technique: T1055.013 Process Injection: Process Doppelgänging, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
Bazar can inject into a target process using process doppelgänging.
Technique: T1055.013 Process Injection: Process Doppelgänging, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
SynAck abuses NTFS transactions to launch and conceal malicious processes.
Technique: T1055.013 Process Injection: Process Doppelgänging, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
InvisiMole has used ListPlanting to inject code into a trusted process.
Technique: T1055.015 Process Injection: ListPlanting, Tactic: TA0005 Defense Evasion TA0004 Privilege Escalation
APT39 has utilized tools to capture mouse movements.
Technique: T1056 Input Capture, Tactic: TA0009 Collection TA0006 Credential Access
Chaes has a module to perform any API hooking it desires.
Technique: T1056 Input Capture, Tactic: TA0009 Collection TA0006 Credential Access
FlawedAmmyy can collect mouse events.
Technique: T1056 Input Capture, Tactic: TA0009 Collection TA0006 Credential Access
Kobalos has used a compromised SSH client to capture the hostname, port, username and password used to establish an SSH connection from the compromised host.
Technique: T1056 Input Capture, Tactic: TA0009 Collection TA0006 Credential Access
Mafalda can conduct mouse event logging.
Technique: T1056 Input Capture, Tactic: TA0009 Collection TA0006 Credential Access
metaMain can log mouse events.
Technique: T1056 Input Capture, Tactic: TA0009 Collection TA0006 Credential Access
During the 2015 Ukraine Electric Power Attack, Sandworm Team gathered account credentials via a BlackEnergy keylogger plugin.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
During Cutting Edge, threat actors modified a JavaScript file on the Web SSL VPN component of Ivanti Connect Secure devices to keylog credentials.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
During Operation Wocao, threat actors obtained the password for the victim's password manager via a custom keylogger.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
APT28 has used tools to perform keylogging.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
APT3 has used a keylogging tool that records keystrokes in encrypted files.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
APT39 has used tools for capturing keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
APT41 used a keylogger called GEARSHIFT on a target system.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
APT5 has used malware with keylogging capabilities to monitor the communications of targeted entities.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Ajax Security Team has used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Darkhotel has used a keylogger.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
FIN13 has logged the keystrokes of victims to escalate privileges.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
FIN4 has captured credentials via fake Outlook Web App (OWA) login pages and has also used a .NET based keylogger.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Malware used by Group5 is capable of capturing keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
HEXANE has used a PowerShell-based keylogger named `kl.ps1`.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Ke3chang has used keyloggers.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Lazarus Group malware KiloAlfa contains keylogging functionality.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Magic Hound malware is capable of keylogging.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
OilRig has used keylogging tools called KEYPUNCH and LONGWATCH.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
PLATINUM has used several different keyloggers.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Sowbug has used keylogging tools.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Tonto Team has used keylogging tools in their operations.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
menuPass has used key loggers to steal usernames and passwords.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
ADVSTORESHELL can perform keylogging.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Agent Tesla can log keystrokes on the victim’s machine.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
AppleSeed can use `GetKeyState` and `GetKeyboardState` to capture keystrokes on the victim’s machine.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Astaroth logs keystrokes from the victim's machine.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
AsyncRAT can capture keystrokes on the victim’s machine.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
One of Attor's plugins can collect user credentials via capturing keystrokes and can capture keystrokes pressed within the window of the injected process.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
When it first starts, BADNEWS spawns a new thread to log keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
BISCUIT can capture keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
BabyShark has a PowerShell-based remote administration ability that can implement a PowerShell or C# based keylogger.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
BadPatch has a keylogging capability.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Bandook contains keylogging capabilities.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
BlackEnergy has run a keylogger plug-in on a victim.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
CHOPSTICK is capable of performing keylogging.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Cadelspy has the ability to log keystrokes on the compromised host.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Carbanak logs key strokes for configured processes and sends them back to the C2 server.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Cardinal RAT can log keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Catchamas collects keystrokes from the victim’s machine.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Clambling can capture keystrokes on a compromised host.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Cobalt Strike can track key presses with a keylogger module.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Cobian RAT has a feature to perform keylogging on the victim’s machine.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
CosmicDuke uses a keylogger.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Crimson can use a module to perform keylogging on compromised hosts.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Cuba logs keystrokes via polling by using `GetKeyState` and `VkKeyScan` functions.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
DOGCALL is capable of logging keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
DarkComet has a keylogging capability.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
DarkGate will spawn a thread on execution to capture all keyboard events and write them to a predefined log file.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
DarkTortilla can download a keylogging module.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
DarkWatchman can track key presses with a keylogger module.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Daserf can log keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Derusbi is capable of logging keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Dtrack’s dropper contains a keylogging executable.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Duqu can track key presses with a keylogger module.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
DustySky contains a keylogger.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
ECCENTRICBANDWAGON can capture and store keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Empire includes keylogging capabilities for Windows, Linux, and macOS systems.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
EvilGrab has the capability to capture keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Explosive has leveraged its keylogging capabilities to gain access to administrator accounts on target servers.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
FakeM contains a keylogger module.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
FlawedAmmyy can collect keyboard events.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
The FunnyDream Keyrecord component can capture keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Fysbis can perform keylogging.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Grandoreiro can log keystrokes on the victim's machine.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
GreyEnergy has a module to harvest pressed keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
HTTPBrowser is capable of capturing keystrokes on victims.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
The executable version of Helminth has a module to log keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Imminent Monitor has a keylogging module.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
InvisiMole can capture keystrokes on a compromised host.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
JPIN contains a custom keylogger.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
KGH_SPY can perform keylogging by polling the `GetAsyncKeyState()` function.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
KONNI has the capability to perform keylogging.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Kasidet has the ability to initiate keylogging.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
KeyBoy installs a keylogger for intercepting credentials and keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Kivars has the ability to initiate keylogging on the infected host.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Lokibot has the ability to capture input on the compromised host via keylogging.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
MacMa can use Core Graphics Event Taps to intercept user keystrokes from any text input field and saves them to text files. Text input fields include Spotlight, Finder, Safari, Mail, Messages, and other apps that have text fields for passwords.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
MacSpy captures keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Machete logs keystrokes from the victim’s machine.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
MarkiRAT can capture all keystrokes on a compromised host.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Matryoshka is capable of keylogging.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Metamorfo has a command to launch a keylogger and capture keystrokes on the victim’s machine.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Micropsia has keylogging capabilities.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Mispadu can log keystrokes on the victim's machine.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
MoonWind has a keylogger.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
NETWIRE can perform keylogging.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
NanoCore can perform keylogging on the victim’s machine.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
NavRAT logs the keystrokes on the targeted system.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
NetTraveler contains a keylogger.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
NightClub can use a plugin for keylogging.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Okrum was seen using a keylogger tool to capture keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
OwaAuth captures and DES-encrypts credentials before writing the username and password to a log file, `C:\log.txt`.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
PcShare has the ability to capture keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Peppy can log keystrokes on compromised hosts.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
PlugX has a module for capturing keystrokes per process including window titles.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
PoetRAT has used a Python tool named klog.exe for keylogging.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
PoisonIvy contains a keylogger.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
PoshC2 has modules for keystroke logging and capturing credentials from spoofed Outlook authentication messages.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
PowerLess can use a module to log keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
PowerSploit's `Get-Keystrokes` Exfiltration module can log keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Prikormka contains a keylogger module that collects keystrokes and the titles of foreground windows.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Proton uses a keylogger to capture keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Pupy uses a keylogger to capture keystrokes it then sends back to the server after it is stopped.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
QakBot can capture keystrokes on a compromised host.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
QuasarRAT has a built-in keylogger.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
RCSession has the ability to capture keystrokes on a compromised host.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
ROKRAT can use  `SetWindowsHookEx` and `GetKeyNameText` to capture keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
RTM can record keystrokes from both the keyboard and virtual keyboard.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Regin contains a keylogger.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Remcos has a command for keylogging.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Remexi gathers and exfiltrates keystrokes from the machine.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Remsec contains a keylogger component.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Revenge RAT has a plugin for keylogging.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Rover has keylogging functionality.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
RunningRAT captures keystrokes and sends them back to the C2 server.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
SILENTTRINITY has a keylogging capability.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
SLOTHFULMEDIA has a keylogging capability.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
SMOKEDHAM can continuously capture keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
SslMM creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Sykipot contains keylogging functionality to steal passwords.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
TajMahal has the ability to capture keystrokes on an infected host.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
ThiefQuest uses the `CGEventTap` functions to perform keylogging.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
TinyZBot contains keylogger functionality.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Trojan.Karagany can capture keystrokes on a compromised host.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Unknown Logger is capable of recording keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
VERMIN collects keystrokes from the victim machine.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
WarzoneRAT has the capability to install a live and offline keylogger, including through the use of the `GetAsyncKeyState` Windows API.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
XAgentOSX contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
Zeus Panda can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_KEYDOWN.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
ZxShell has a feature to capture a remote computer's keystrokes using a keylogger.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
gh0st RAT has a keylogger.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
jRAT has the capability to log keystrokes from the victim’s machine, both offline and online.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
metaMain has the ability to log keyboard events.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
njRAT is capable of logging keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
yty uses a keylogger plugin to gather keystrokes.
Technique: T1056.001 Input Capture: Keylogging, Tactic: TA0009 Collection TA0006 Credential Access
FIN4 has presented victims with spoofed Windows Authentication prompts to collect their credentials.
Technique: T1056.002 Input Capture: GUI Input Capture, Tactic: TA0009 Collection TA0006 Credential Access
Bundlore prompts the user for their credentials.
Technique: T1056.002 Input Capture: GUI Input Capture, Tactic: TA0009 Collection TA0006 Credential Access
Calisto presents an input prompt asking for the user's login and password.
Technique: T1056.002 Input Capture: GUI Input Capture, Tactic: TA0009 Collection TA0006 Credential Access
Dok prompts the user for credentials.
Technique: T1056.002 Input Capture: GUI Input Capture, Tactic: TA0009 Collection TA0006 Credential Access
Keydnap prompts the users for credentials.
Technique: T1056.002 Input Capture: GUI Input Capture, Tactic: TA0009 Collection TA0006 Credential Access
Metamorfo has displayed fake forms on top of banking sites to intercept credentials from victims.
Technique: T1056.002 Input Capture: GUI Input Capture, Tactic: TA0009 Collection TA0006 Credential Access
Mispadu can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.
Technique: T1056.002 Input Capture: GUI Input Capture, Tactic: TA0009 Collection TA0006 Credential Access
Proton prompts users for their credentials.
Technique: T1056.002 Input Capture: GUI Input Capture, Tactic: TA0009 Collection TA0006 Credential Access
SILENTTRINITY's `credphisher.py` module can prompt a current user for their credentials.
Technique: T1056.002 Input Capture: GUI Input Capture, Tactic: TA0009 Collection TA0006 Credential Access
XCSSET prompts the user to input credentials using a native macOS dialog box leveraging the system process `/Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment`.
Technique: T1056.002 Input Capture: GUI Input Capture, Tactic: TA0009 Collection TA0006 Credential Access
iKitten prompts the user for their credentials.
Technique: T1056.002 Input Capture: GUI Input Capture, Tactic: TA0009 Collection TA0006 Credential Access
During Cutting Edge, threat actors modified the JavaScript loaded by the Ivanti Connect Secure login page to capture credentials entered.
Technique: T1056.003 Input Capture: Web Portal Capture, Tactic: TA0009 Collection TA0006 Credential Access
In the Triton Safety Instrumented System Attack, TEMP.Veles captured credentials as they were being changed by redirecting text-based login codes to websites they controlled.
Technique: T1056.003 Input Capture: Web Portal Capture, Tactic: TA0009 Collection TA0006 Credential Access
The IceApple OWA credential logger can monitor for OWA authentication requests and log the credentials.
Technique: T1056.003 Input Capture: Web Portal Capture, Tactic: TA0009 Collection TA0006 Credential Access
WARPWIRE can capture credentials submitted during the web logon process in order to access layer seven applications such as RDP.
Technique: T1056.003 Input Capture: Web Portal Capture, Tactic: TA0009 Collection TA0006 Credential Access
PLATINUM is capable of using Windows hook interfaces for information gathering such as credential access.
Technique: T1056.004 Input Capture: Credential API Hooking, Tactic: TA0009 Collection TA0006 Credential Access
Carberp has hooked several Windows API functions to steal credentials.
Technique: T1056.004 Input Capture: Credential API Hooking, Tactic: TA0009 Collection TA0006 Credential Access
Empire contains some modules that leverage API hooking to carry out tasks, such as netripper.
Technique: T1056.004 Input Capture: Credential API Hooking, Tactic: TA0009 Collection TA0006 Credential Access
FinFisher hooks processes by modifying IAT pointers to CreateWindowEx.
Technique: T1056.004 Input Capture: Credential API Hooking, Tactic: TA0009 Collection TA0006 Credential Access
NOKKI uses the Windows call SetWindowsHookEx and begins injecting it into every GUI process running on the victim's machine.
Technique: T1056.004 Input Capture: Credential API Hooking, Tactic: TA0009 Collection TA0006 Credential Access
RDFSNIFFER hooks several Win32 API functions to hijack elements of the remote system management user-interface.
Technique: T1056.004 Input Capture: Credential API Hooking, Tactic: TA0009 Collection TA0006 Credential Access
TrickBot has the ability to capture RDP credentials by capturing the `CredEnumerateA` API
Technique: T1056.004 Input Capture: Credential API Hooking, Tactic: TA0009 Collection TA0006 Credential Access
Ursnif has hooked APIs to perform a wide variety of information theft, such as monitoring traffic from browsers.
Technique: T1056.004 Input Capture: Credential API Hooking, Tactic: TA0009 Collection TA0006 Credential Access
Zebrocy installs an application-defined Windows hook to get notified when a network drive has been attached, so it can then use the hook to call its RecordToFile file stealing method.
Technique: T1056.004 Input Capture: Credential API Hooking, Tactic: TA0009 Collection TA0006 Credential Access
Zeus Panda hooks processes by leveraging its own IAT hooked functions.
Technique: T1056.004 Input Capture: Credential API Hooking, Tactic: TA0009 Collection TA0006 Credential Access
ZxShell hooks several API functions to spawn system threads.
Technique: T1056.004 Input Capture: Credential API Hooking, Tactic: TA0009 Collection TA0006 Credential Access
During C0015, the threat actors used the `tasklist /s` command as well as `taskmanager` to obtain a list of running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
During Frankenstein, the threat actors used Empire to obtain a list of all running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
During FunnyDream, the threat actors used Tasklist on targeted systems.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
During Operation CuckooBees, the threat actors used the `tasklist` command as part of their advanced reconnaissance.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
During Operation Honeybee, the threat actors obtained a list of running processes on a victim machine using `cmd /c tasklist > %temp%\temp.ini`.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
During Operation Wocao, the threat actors used `tasklist` to collect a list of running processes on an infected system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
During the SolarWinds Compromise, APT29 used multiple command-line utilities to enumerate running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
APT1 gathered a list of running processes on the system using `tasklist /v`.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
APT3 has a tool that can list out currently running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
APT37's Freenki malware lists running processes using the Microsoft Windows API.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
APT38 leveraged Sysmon to understand the processes, services in the organization.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
APT5 has used Windows-based utilities to carry out tasks including tasklist.exe.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Andariel has used `tasklist` to enumerate processes and find a specific string.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Chimera has used `tasklist` to enumerate processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Darkhotel malware can collect a list of running processes on a system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Earth Lusca has used Tasklist to obtain information from a compromised host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
HAFNIUM has used `tasklist` to enumerate processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
HEXANE has enumerated processes on targeted systems.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Higaisa’s shellcode attempted to find the process ID of the current process.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Inception has used a reconnaissance module to identify active processes and other associated loaded modules.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Ke3chang performs process discovery using `tasklist` commands.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Kimsuky can gather a list of all processes running on a victim's machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Magic Hound malware can list running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
MuddyWater has used malware to obtain a list of running processes on the system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Mustang Panda has used `tasklist /v` to determine active process information.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
OilRig has run `tasklist` on a victim's machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
After compromising a victim, Poseidon Group lists all running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Rocke can detect a running process's PID on the infected machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Sidewinder has used tools to identify running processes on the victim's machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Stealth Falcon malware gathers a list of running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
TeamTNT has searched for rival malware and removes it if found. TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
ToddyCat has run `cmd /c start /b tasklist` to enumerate processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Tropic Trooper is capable of enumerating the running processes on the system using `pslist`.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Turla surveys a system upon check-in to discover running processes using the `tasklist /v` command. Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Volt Typhoon has enumerated running processes on targeted systems.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Windshift has used malware to enumerate active processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Winnti Group looked for a specific process running on infected servers.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
4H RAT has the capability to obtain a listing of running processes (including loaded modules).
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
ADVSTORESHELL can list running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Agent Tesla can list the current running processes on the system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Akira verifies the deletion of volume shadow copies by checking for the existence of the process ID related to the process created to delete these items.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
AppleSeed can enumerate the current process on a compromised host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Aria-body has the ability to enumerate loaded modules for a process..
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Astaroth searches for different processes on the system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
AsyncRAT can examine running processes to determine if a debugger is present.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Avaddon has collected information about running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Avenger has the ability to use Tasklist to identify running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
AvosLocker has discovered system processes by calling `RmGetList`.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
BACKSPACE may collect information about running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
BADHATCH can retrieve a list of running processes from a compromised machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
BBSRAT can list running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
BISCUIT has a command to enumerate running processes and identify their owners.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
BLACKCOFFEE has the capability to discover processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
BLUELIGHT can collect process filenames and SID authority level.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Babuk has the ability to check running processes on a targeted system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
BabyShark has executed the `tasklist` command.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Backdoor.Oldrea collects information about running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Bad Rabbit can enumerate all running processes to compare hashes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Bankshot identifies processes and collects the process ids.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Bazar can identity the current process on a compromised host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Bisonal can obtain a list of running processes on the victim’s machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
BlackEnergy has gathered a process list by using Tasklist.exe.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Bonadan can use the `ps` command to discover other cryptocurrency miners active on the system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Brave Prince lists the running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Brute Ratel C4 can enumerate all processes and locate specific process IDs (PIDs).
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Bumblebee can identify processes associated with analytical tools.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Bundlore has used the `ps` command to list processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
COATHANGER will query running process information to determine subsequent program execution flow.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
CaddyWiper can obtain a list of current processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Cannon can obtain a list of processes running on the system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Carbanak lists running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Carberp has collected a list of running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Carbon can list the processes on the victim’s machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Caterpillar WebShell can gather a list of processes running on the machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
ChChes collects its process identifier (PID) on the victim.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
CharmPower has the ability to list running processes through the use of `tasklist`.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Clambling can enumerate processes on a targeted system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Clop can enumerate all processes on the victim's machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Cobalt Strike's Beacon payload can collect information on process details.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Comnie uses the `tasklist` to view running processes on the victim’s machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Conti can enumerate through all open processes to search for any that have the string “sql” in their process name.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Crimson contains a command to list processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Cuba can enumerate processes running on a victim's machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Cyclops Blink can enumerate the process it is currently running under.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
DRATzarus can enumerate and examine running processes to determine if a debugger is present.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Dacls can collect data on running and parent processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
DarkComet can list active processes running on the victim’s machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
DarkGate performs various checks for running processes, including security software by looking for hard-coded process name values.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
DarkTortilla can enumerate a list of running processes on a compromised system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Derusbi collects current and parent process IDs.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Diavol has used `CreateToolhelp32Snapshot`, `Process32First`, and `Process32Next` API calls to enumerate the running processes in the system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Doki has searched for the current process’s PID.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Donut includes subprojects that enumerate and identify information about Process Injection candidates.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Dtrack’s dropper can list all running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
The discovery modules used with Duqu can collect information on process details.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
DustySky collects information about running processes from victims.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
EKANS looks for processes from a hard-coded list.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
ELMER is capable of performing process listings.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Elise enumerates processes via the `tasklist` command.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Emotet has been observed enumerating local processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Empire can find information about processes running on local and remote systems.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Epic uses the `tasklist /v` command to obtain a list of processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
EvilBunny has used EnumProcesses() to identify how many process are running in the environment.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
FELIXROOT collects a list of running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
FatDuke can list running processes on the localhost.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
FinFisher checks its parent process for indications that it is running in a sandbox setup.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Final1stspy obtains a list of running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Flagpro has been used to run the `tasklist` command on a compromised system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
FoggyWeb's loader can enumerate all Common Language Runtimes (CLRs) and running Application Domains in the compromised AD FS server's `Microsoft.IdentityServer.ServiceHost.exe` process.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
FrameworkPOS can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
FruitFly has the ability to list processes on the system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
FunnyDream has the ability to discover processes, including `Bka.exe` and `BkavUtil.exe`.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Fysbis can collect information about running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Gelsemium can enumerate running processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
GeminiDuke collects information on running processes and environment variables from the victim.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Get2 has the ability to identify running processes on an infected host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Gold Dragon checks the running processes on the victim’s machine.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Grandoreiro can identify installed security tools based on process names.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
GravityRAT lists the running processes on the system.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
HALFBAKED can obtain information about running processes on the victim.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
HELLOKITTY can search for specific processes to terminate.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Helminth has used Tasklist to get information on processes.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
Heyoka Backdoor can gather process information.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery
HotCroissant has the ability to list running processes on the infected host.
Technique: T1057 Process Discovery, Tactic: TA0007 Discovery