{"id":"60f1ce20-484e-41bd-85f4-ac4afec2c541","title":"GUI Input Capture - macOS","description":"Detects attempts to use system dialog prompts to capture user credentials","author":"remotephone, oscd.community","status":"test","level":"low","date":"2020-10-13","modified":"2025-12-05","tags":["attack.collection","attack.credential-access","attack.t1056.002"],"technique_ids":["T1056.002"],"logsource":{"product":"macos","category":"process_creation"},"falsepositives":["Legitimate administration tools and activities"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md","https://scriptingosx.com/2018/08/user-interaction-from-bash-scripts/"],"source_path":"rules/macos/process_creation/proc_creation_macos_gui_input_capture.yml","source_sha256":"f88a09d358f44d106e39197b58b8ffc6f3428680e2c9d4babc7dbc20ca17d01c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_gui_input_capture.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: GUI Input Capture - macOS\nid: 60f1ce20-484e-41bd-85f4-ac4afec2c541\nstatus: test\ndescription: Detects attempts to use system dialog prompts to capture user credentials\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md\n    - https://scriptingosx.com/2018/08/user-interaction-from-bash-scripts/\nauthor: remotephone, oscd.community\ndate: 2020-10-13\nmodified: 2025-12-05\ntags:\n    - attack.collection\n    - attack.credential-access\n    - attack.t1056.002\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection_img:\n        Image|endswith: '/osascript'\n    selection_cli_1:\n        CommandLine|contains|all:\n            - '-e'\n            - 'display'\n            - 'dialog'\n            - 'answer'\n    selection_cli_2:\n        CommandLine|contains:\n            - 'admin'\n            - 'administrator'\n            - 'authenticate'\n            - 'authentication'\n            - 'credentials'\n            - 'pass'\n            - 'password'\n            - 'unlock'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate administration tools and activities\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1056.002","id":"T1056.002","name":"GUI Input Capture","page":"techniques/enterprise/T1056.002/"}],"data_path":"data/detection-rules/60f1ce20-484e-41bd-85f4-ac4afec2c541.json","kind":"sigma"}