GUI Input Capture
Subtechnique · ATTACK:enterprise:T1056.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1056.002",
"title": "GUI Input Capture",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1056/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--a2029942-0a85-4947-b23c-ca434698171d",
"external_id": "T1056.002",
"domain": "enterprise",
"created": "2020-02-11T18:58:45.908Z",
"modified": "2026-05-12T15:12:00.706Z",
"version": "1.3",
"aliases": [
],
"tactics": [
"collection",
"credential-access"
],
"source_references": [
{
"source_name": "LogRhythm Do You Trust Oct 2014",
"url": "https://logrhythm.com/blog/do-you-trust-your-computer/"
},
{
"source_name": "Spoofing credential dialogs",
"url": "https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/"
},
{
"source_name": "OSX Keydnap malware",
"url": "https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/"
},
{
"source_name": "Enigma Phishing for Credentials Jan 2015",
"url": "https://enigma0x3.net/2015/01/21/phishing-for-credentials-if-you-want-it-just-ask/"
},
{
"source_name": "OSX Malware Exploits MacKeeper",
"url": "https://baesystemsai.blogspot.com/2015/06/new-mac-os-malware-exploits-mackeeper.html"
}
]
}Explicit source assertions (19)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0279 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0908b4ce-fcfc-4307-a887-70fc8c27da3a
objsee mac malware 2017ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ad3d8aa-34af-464a-9033-f8d022f8f2f9
MIcrosoft Mastra npm Compromise JUN 2026ATTACK:enterprise:S9036 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25cf6c1e-df68-4fe9-8a4b-dab7843e80ba
ESET_MuddyWater_Dec2025ATTACK:enterprise:S0278 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31a72381-c672-404f-afd2-17bfb2aa3078
objsee mac malware 2017ATTACK:enterprise:S9064 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c4f4b33-5d07-4447-9ff1-6f1f8d817bdb
Mandiant_UNC1549_Nov2025ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a56cf34-c344-4b2a-ac9e-4f08f049d7ce
FireEye Metamorfo Apr 2018ATTACK:enterprise:T1056.002 → subtechnique-of → ATTACK:enterprise:T1056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6db133fd-2beb-4c5e-a97c-3d3ef03bee50
ATTACK:enterprise:S0274 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7566c29c-f071-40fa-a437-34d2f36eadb6
Symantec Calisto July 2018ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ead2d52-702b-4894-a27d-755e6bd68d32
ESET_MuddyWater_Dec2025ATTACK:enterprise:S0276 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7eef6b42-8c4c-4619-b0ed-fa17f16de722
synack 2016 reviewATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--824d51cd-f599-4a1d-afb1-4b3a51032d54
group-ib_redcurl1 · group-ib_redcurl2ATTACK:enterprise:S0482 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9480dac9-9192-4966-a622-0ca561b59f16
MacKeeper Bundlore Apr 2019ATTACK:enterprise:G0085 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a568a6a5-860b-4fe1-9f00-ab6fbbb41a26
FireEye Hacking FIN4 Video Dec 2014 · FireEye Hacking FIN4 Dec 2014ATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7744970-817e-43c6-89e4-86907ac20361
objsee mac malware 2017ATTACK:enterprise:S1122 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa6411df-8f39-4368-9b35-45cc2a7394d8
Segurança Informática URSA Sophisticated Loader 2020 · SCILabs Malteiro 2021ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b019c5ea-be5e-453a-9ed6-e86384c92259
trendmicro xcsset xcode project 2020ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b921aed3-07ce-49b0-8051-48807fa82ea7
ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e6553c0d-9f67-412a-8e72-fad7059c35b1
GitHub SILENTTRINITY Modules July 2019ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fb527052-60a5-42d9-98ba-9388b29e2ac1
Kandji Cuckoo April 2024