[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1056-001":3},{"item":4,"lessons":18,"controls":44,"related":73},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1056-001","T1056.001","Keylogging",6,"MITRE","**What attackers do.** Attackers record keystrokes to capture passwords and other sensitive input as users type them. Keyloggers can be part of malware, browser extensions or hardware devices. This serves Collection and Credential Access.\n\n**How to defend.** Use endpoint protection that detects keylogging behaviour, manage browser extensions, and use phishing-resistant MFA so captured passwords alone do not grant access. Control physical access to keyboards and USB ports in sensitive areas.\n\n**Signs to look for.** Look for processes setting keyboard hooks or polling key states, unusual log files growing in temp folders, unknown USB devices and data being sent out regularly from infected hosts. A common gap is that keylogging uses legitimate operating system features, so detection depends on behaviour analysis.","Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.\n\nKeylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes. Some methods include:\n\n* Hooking API callbacks used for processing keystrokes. Unlike Credential API Hooking, this focuses solely on API functions intended for processing keystroke data.\n* Reading raw keystroke data from the hardware buffer.\n* Windows Registry modifications.\n* Custom drivers.\n* Modify System Image may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1056\u002F001\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40],{"slug":21,"title":22,"published_at":23},"file-notification-apis-silently-expose-user-behavior-across-major-oses","File Notification APIs Silently Expose User Behavior Across Major OSes","2026-09-25T12:20:35.783+00:00",{"slug":25,"title":26,"published_at":27},"clickfix-social-engineering-delivers-stealers-and-password-phishing-malware","ClickFix Social Engineering Delivers Stealers and Password Phishing Malware","2026-08-24T14:20:58.027+00:00",{"slug":29,"title":30,"published_at":31},"memory-resident-backdoors-octlurk-silklurk-target-central-asian-governments","Memory-Resident Backdoors OctLurk & SilkLurk Target Central Asian Governments","2026-07-30T12:20:40.699+00:00",{"slug":33,"title":34,"published_at":35},"clicklock-stealer-exploits-macos-users-via-social-engineering-and-fake-fix-pages","ClickLock Stealer Exploits macOS Users via Social Engineering and Fake Fix Pages","2026-07-16T14:21:40.319+00:00",{"slug":37,"title":38,"published_at":39},"ousaban-banking-trojan-uses-phishing-pdfs-to-steal-iberian-banking-credentials","Ousaban Banking Trojan Uses Phishing PDFs to Steal Iberian Banking Credentials","2026-07-01T16:20:22.247+00:00",{"slug":41,"title":42,"published_at":43},"fake-perplexity-chrome-extension-silently-harvested-every-keystroke","Fake Perplexity Chrome Extension Silently Harvested Every Keystroke","2026-06-29T20:20:40.249+00:00",[45,50,55,60,64,69],{"slug":46,"name":47,"problem":48,"stories":49},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",5,{"slug":51,"name":52,"problem":53,"stories":54},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",3,{"slug":56,"name":57,"problem":58,"stories":59},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",2,{"slug":61,"name":62,"problem":63,"stories":59},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":65,"name":66,"problem":67,"stories":68},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",1,{"slug":70,"name":71,"problem":72,"stories":68},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[74,79,84,90,94,98,102,106],{"family":75,"item":76,"code":77,"title":78,"together":49},"gdpr","32","Article 32","Security of processing",{"family":80,"item":81,"code":82,"title":83,"together":49},"nist-800-53","si-3","SI-3","Malicious Code Protection",{"family":85,"item":86,"code":87,"title":88,"together":89},"cis","13","Control 13","Network Monitoring and Defense",4,{"family":85,"item":91,"code":92,"title":93,"together":54},"14","Control 14","Security Awareness and Skills Training",{"family":85,"item":95,"code":96,"title":97,"together":54},"10","Control 10","Malware Defenses",{"family":80,"item":99,"code":100,"title":101,"together":54},"at-2","AT-2","Literacy Training and Awareness",{"family":85,"item":103,"code":104,"title":105,"together":59},"9","Control 9","Email and Web Browser Protections",{"family":85,"item":107,"code":108,"title":109,"together":59},"4","Control 4","Secure Configuration of Enterprise Assets and Software"]