1200KM / detection
T1056 Input Capture — Detection Rules
Detection workspace for T1056 Input Capture: 2 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Suspicious Network Communication With IPFS · test · low · {"category":"proxy"}
- DNS Query Request To OneLaunch Update Service · test · low · {"category":"dns_query","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0102 Behavioral Detection of Input Capture Across Platforms
AN0282 Analytic 0282
Monitors for abnormal process behavior and API calls like SetWindowsHookEx, GetAsyncKeyState, or device input polling commonly used for keystroke logging.
AN0283 Analytic 0283
Detects use of tools/scripts accessing input devices like /dev/input/* or evdev via suspicious processes lacking GUI context.
AN0284 Analytic 0284
Monitors for TCC-bypassing or unauthorized access to input services like IOHIDSystem or Quartz Event Services used in keylogging or screen monitoring.
AN0285 Analytic 0285
Detects web-based credential phishing by analyzing traffic to suspicious URLs that mimic login portals and POST credential content.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.