1200KM / simulation
Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal…
Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture).
Official technique definition · Open in the interactive matrix
Related pages are navigation context. Their tools, rules and lab results are not automatically inherited.
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
DC0055 collection page — Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.
Required normalized fields: path, access, actor, result.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0055",
"collector": "illustrative-lab-collector",
"observation": {
"path": "C:\\Lab\\demo.txt",
"access": "read",
"actor": "LAB\\analyst",
"result": "success"
}
}Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
DC0061 collection page — Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.
Required normalized fields: path, attribute, before, after.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0061",
"collector": "illustrative-lab-collector",
"observation": {
"path": "C:\\Lab\\demo.txt",
"attribute": "content_hash",
"before": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"after": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
}
}Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
DC0082 collection page — Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.
Required normalized fields: process_guid, destination_ip, destination_port, protocol, initiated.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0082",
"collector": "illustrative-lab-collector",
"observation": {
"process_guid": "lab-process-001",
"destination_ip": "198.51.100.20",
"destination_port": 443,
"protocol": "tcp",
"initiated": true
}
}Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
DC0085 collection page — Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.
Required normalized fields: flow_id, protocol, method, path, payload_excerpt.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0085",
"collector": "illustrative-lab-collector",
"observation": {
"flow_id": "lab-flow-1",
"protocol": "http",
"method": "GET",
"path": "/lab-check",
"payload_excerpt": "LAB_TELEMETRY_CHECK"
}
}Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.
DC0021 collection page — Use an approved EDR trace or instrument the owned lab process at selected APIs. Define API name, caller, sanitized arguments and return status.
Required normalized fields: process_id, api, path, result.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0021",
"collector": "illustrative-lab-collector",
"observation": {
"process_id": 4200,
"api": "CreateFileW",
"path": "C:\\Lab\\demo.txt",
"result": "success"
}
}Visibility limits: Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.
DC0035 collection page — Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.
Required normalized fields: source_process_id, target_process_id, granted_access, action.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0035",
"collector": "illustrative-lab-collector",
"observation": {
"source_process_id": 4200,
"target_process_id": 4300,
"granted_access": "0x1000",
"action": "open_process"
}
}Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.
Required normalized fields: process_guid, image, parent_image, command_line, user.
<EventFiltering>
<ProcessCreate onmatch="include">
<Image condition="is">C:\Windows\System32\whoami.exe</Image>
</ProcessCreate>
</EventFiltering>This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0032",
"collector": "illustrative-lab-collector",
"observation": {
"process_guid": "lab-process-001",
"image": "C:\\Windows\\System32\\whoami.exe",
"parent_image": "C:\\Windows\\System32\\cmd.exe",
"command_line": "whoami",
"user": "LAB\\analyst"
}
}Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
DC0034 collection page — Collect read-only process inventory with PID plus start time/stable identity, command line and collection time; restrict access to potentially sensitive arguments.
Required normalized fields: process_id, image, owner_uid, started_at.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0034",
"collector": "illustrative-lab-collector",
"observation": {
"process_id": 4200,
"image": "/usr/bin/sleep",
"owner_uid": 1000,
"started_at": "2026-09-27T11:59:00Z"
}
}Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.
Open the dedicated detection workspace · Existing query engineering
Monitors for abnormal process behavior and API calls like SetWindowsHookEx, GetAsyncKeyState, or device input polling commonly used for keystroke logging.
Platforms: Windows.
Detects use of tools/scripts accessing input devices like /dev/input/* or evdev via suspicious processes lacking GUI context.
Platforms: Linux.
Monitors for TCC-bypassing or unauthorized access to input services like IOHIDSystem or Quartz Event Services used in keylogging or screen monitoring.
Platforms: macOS.
Detects web-based credential phishing by analyzing traffic to suspicious URLs that mimic login portals and POST credential content.
Platforms: Network Devices.
2 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.
No exact technique-specific Atlas model is present for T1056 in the selected source snapshot. The following is a design worksheet, not a newly validated model.
Start from the exact analytic above. The collection-specific lenses below are analyst recommendations; they do not assert that an arbitrary statistical deviation detects this technique.
Anomaly Detection Atlas · Baseline, validation and blind spots
These are exact ATT&CK software-use relationships, including malware. They provide behavior context, not recommendations to download or execute malware. No safety or detector claim is inherited.
FlawedAmmyy can collect mouse events.[Korean FSI TA505 2020]
Exact relationship: relationship--ae3897f5-099d-46b0-b645-81a9a45445faChaes has a module to perform any API hooking it desires.[Cybereason Chaes Nov 2020]
Exact relationship: relationship--a74d38f5-92dc-4944-b840-0ab567f8f3abKobalos has used a compromised SSH client to capture the hostname, port, username and password used to establish an SSH connection from the compromised host.[ESET Kobalos Feb 2021][ESET Kobalos Jan 2021]
Exact relationship: relationship--cf2df7c3-3efe-49d9-9c49-e35978d784c4metaMain can log mouse events.[SentinelLabs Metador Technical Appendix Sept 2022]
Exact relationship: relationship--69d4f4f9-adb0-41fc-952d-88579ab5b46bMafalda can conduct mouse event logging.[SentinelLabs Metador Technical Appendix Sept 2022]
Exact relationship: relationship--6eb97f82-c49f-465d-b788-15a789f928b5NPPSPY captures user input into the Winlogon process by redirecting RPC traffic from legitimate listening DLLs within the operating system to a newly registered malicious item that allows for recording logon information in cleartext.[Huntress NPPSPY 2022]
Exact relationship: relationship--dd9677aa-d14a-427f-9b47-2ce722278344InvisibleFerret has collected mouse and keyboard events using “pyWinhook”.[PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023]
Exact relationship: relationship--244a8358-96fb-41ce-9cc3-c4899a6f4de4Atomic evidence: no compatible candidate in this snapshot. Live lab status: not run for these imported procedures.
Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.
No compatible Atomic procedure is present in this pinned evidence set. Technical feasibility has not been ruled out. A custom procedure must define the behavior, target, collection point, success observable and rollback before execution.
Download synthetic collection fixture (JSON) · Download the complete engineering workbook
This fixture exercises the listed collection fields. It does not reproduce Input Capture, label its example events as malicious, or measure detection effectiveness. Use the exact analytic and selected procedure to build an independently labelled behavior-positive dataset.
Not run in this browser. No network scan or attack command is executed by this control.
All-page audit and evidence inventory · This page’s machine-readable workbook
Pinned MITRE STIX source · SHA-256 81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352. Definition and procedure context are reproduced from this snapshot, not independently re-investigated incidents.
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.