T1056: Input Capture
T1056 (Input Capture) is classified under the Credential Access tactic within the MITRE ATT&CK framework. Techniques for stealing credentials such as plaintext passwords, password hashes, and Kerberos tickets using memory dumping (LSASS) and browser credential store decryption. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 23 distinct malware families, totaling over 3,028 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage Input Capture to accomplish operational objectives while minimizing anomalous forensic footprints. When executing Input Capture, malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1056 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute Input Capture to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
https://attack.mitre.org/techniques/T1056/.
Detection Engineering & Threat Hunting
Detecting Input Capture requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1056 (Input Capture) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing Input Capture across adjacent network segments.
Cataloged Malware Families Utilizing T1056 (23 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1056 (Input Capture):
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| erazer | Trojan | 1,500 | Erazer (identified across antivirus engines as Trojan:Win32/Erazer and Backdoor.Erazer) is a classic dual-function Remote Access Trojan (RAT) and disruptive dis... |
| erazer_lite | Trojan | 1,500 | Erazer Lite (tracked as Trojan:Win32/ErazerLite and Backdoor.Erazer.Lite) is a streamlined, optimized variant of the parent Erazer remote access trojan codebase... |
| opanki | Backdoor | 9 | Worm:Win32/Opanki is a legacy, self-propagating worm that gained extreme prevalence in the mid-to-late 2000s by aggressively exploiting Instant Messaging (IM) n... |
| screenmate | Advanced Threat | 6 | Joke:Win32/Screenmate (also classified as Riskware or PUA) refers to a broad category of vintage novelty programs designed to display animated characters, anima... |
| siplog | Trojan | 2 | Trojan:Win32/Siplog is a specialized Information Stealer designed specifically to target and compromise Voice over IP (VoIP) communications. Its primary objecti... |
| cashfiesta | Trojan | 1 | Cashfiesta (classified in antivirus detection telemetry under designations including Trojan:Win32/Cashfiesta, Trojan.Win32.Cashfiesta, and Win32/Cashfiesta) is ... |
| chinad | Ransomware | 1 | <h3>Executive Summary</h3> ChinaAd (also referred to as Chinad) is a prevalent family of Adware, Spyware, and Potentially Unwanted Programs (PUPs) originating f... |
| clipspy | Advanced Threat | 1 | <h3>Executive Summary</h3> ClipSpy is a utility designed to monitor, inspect, and log the contents of the Windows system clipboard. While it can be utilized leg... |
| comproc | Trojan | 1 | <h3>Executive Summary</h3> Comproc is a highly sophisticated Trojan that frequently exhibits Rootkit-like capabilities. It is designed to covertly infiltrate Wi... |
| eventmonitor | Advanced Threat | 1 | <h3>Executive Summary</h3> EventMonitor represents a class of software that falls into the "Riskware" or "HackTool" category. While occasionally functioning as ... |
| ggdoor | Trojan | 1 | <h3>Executive Summary</h3> GGDoor is a dangerous Backdoor Trojan engineered to provide remote attackers with covert, persistent, and unfettered access to compro... |
| pclnt | Trojan | 1 | <h3>Executive Summary</h3> Pclnt is a dangerous Backdoor Trojan engineered to provide remote attackers with covert, persistent, and unfettered access to comprom... |
| slingshot | Advanced Threat | 1 | <h3>Executive Summary</h3> Slingshot is an exceptionally sophisticated, modular Advanced Persistent Threat (APT) platform discovered in 2018 (though believed to... |
| snifie | Advanced Threat | 1 | <h3>Executive Summary</h3> Snifie is a specialized Information Stealer and Network Sniffer. Unlike standard info-stealers that rely on extracting passwords from... |
| tongji | Ransomware | 1 | <h3>Executive Summary</h3> Tongji is a family of Adware, Spyware, and Potentially Unwanted Programs (PUPs), frequently originating from Chinese software markets... |
| vkbase | Ransomware | 1 | <h3>Executive Summary</h3> VKbase is a specialized Trojan and Adware family designed explicitly to target and abuse users of the VKontakte (VK) social media net... |
| amiboide | Backdoor | Sampled | Amiboide is a historical malware family that primarily operated as a trojan horse, targeting Windows operating systems. It was often distributed through malicio... |
| apocalypse_rat | Rat | Sampled | Apocalypse RAT (Remote Access Trojan) is a potent piece of malware designed to provide threat actors with comprehensive control over compromised Windows systems... |
| back_orifice | Backdoor | Sampled | Back Orifice, created by the hacker group Cult of the Dead Cow (cDc) and released in 1998, is one of the most infamous remote administration tools (RATs) in cyb... |
| bandook | Rat | Sampled | Bandook (derived from the Arabic and Hindi word for 'gun' or 'rifle') is an enduring, modular Remote Access Trojan first created in 2005 by Lebanese software au... |
| beast | Rat | Sampled | Beast is a notorious Remote Access Trojan (RAT) that gained significant popularity in the early 2000s, primarily targeting Windows operating systems (Windows 95... |
| bersek | Backdoor | Sampled | Bersek is an intricate malware strain primarily characterized by its capabilities as a backdoor and information stealer. It infiltrates systems typically via so... |
| bozok | Trojan | Sampled | Bozok is a highly capable Remote Access Trojan (RAT) that first appeared on cybercriminal forums around 2015. Developed in Delphi, Bozok is designed with stealt... |