New to CAPEC? Start Here
Home > CAPEC List > CAPEC-568: Capture Credentials via Keylogger (Version 3.8)  

CAPEC-568: Capture Credentials via Keylogger

Attack Pattern ID: 568
Abstraction: Detailed
Presentation Filter:
+ Description
An adversary deploys a keylogger in an effort to obtain credentials directly from a system's user. After capturing all the keystrokes made by a user, the adversary can analyze the data and determine which string are likely to be passwords or other credential related information.
+ Typical Severity

High

+ Relationships
Section HelpThis table shows the other attack patterns and high level categories that are related to this attack pattern. These relationships are defined as ChildOf and ParentOf, and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as CanFollow, PeerOf, and CanAlsoBe are defined to show similar attack patterns that the user may want to explore.
NatureTypeIDName
ChildOfStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.569Collect Data as Provided by Users
CanFollowDetailed Attack PatternDetailed Attack Pattern - A detailed level attack pattern in CAPEC provides a low level of detail, typically leveraging a specific technique and targeting a specific technology, and expresses a complete execution flow. Detailed attack patterns are more specific than meta attack patterns and standard attack patterns and often require a specific protection mechanism to mitigate actual attacks. A detailed level attack pattern often will leverage a number of different standard level attack patterns chained together to accomplish a goal.270Modification of Registry Run Keys
CanPrecedeMeta Attack PatternMeta Attack Pattern - A meta level attack pattern in CAPEC is a decidedly abstract characterization of a specific methodology or technique used in an attack. A meta attack pattern is often void of a specific technology or implementation and is meant to provide an understanding of a high level approach. A meta level attack pattern is a generalization of related group of standard level attack patterns. Meta level attack patterns are particularly useful for architecture and design level threat modeling exercises.151Identity Spoofing
CanPrecedeMeta Attack PatternMeta Attack Pattern - A meta level attack pattern in CAPEC is a decidedly abstract characterization of a specific methodology or technique used in an attack. A meta attack pattern is often void of a specific technology or implementation and is meant to provide an understanding of a high level approach. A meta level attack pattern is a generalization of related group of standard level attack patterns. Meta level attack patterns are particularly useful for architecture and design level threat modeling exercises.560Use of Known Domain Credentials
CanPrecedeDetailed Attack PatternDetailed Attack Pattern - A detailed level attack pattern in CAPEC provides a low level of detail, typically leveraging a specific technique and targeting a specific technology, and expresses a complete execution flow. Detailed attack patterns are more specific than meta attack patterns and standard attack patterns and often require a specific protection mechanism to mitigate actual attacks. A detailed level attack pattern often will leverage a number of different standard level attack patterns chained together to accomplish a goal.561Windows Admin Shares with Stolen Credentials
CanPrecedeStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.600Credential Stuffing
CanPrecedeStandard Attack PatternStandard Attack Pattern - A standard level attack pattern in CAPEC is focused on a specific methodology or technique used in an attack. It is often seen as a singular piece of a fully executed attack. A standard attack pattern is meant to provide sufficient details to understand the specific technique and how it attempts to accomplish a desired goal. A standard level attack pattern is a specific type of a more abstract meta level attack pattern.653Use of Known Operating System Credentials
Section HelpThis table shows the views that this attack pattern belongs to and top level categories within that view.
+ Execution Flow
Explore
  1. Determine which user's credentials to capture: Since this is a more targeted attack, an adversary will first identify a particular user they wish the capture the credentials of.

Experiment
  1. Deploy keylogger: Once a user is identified, an adversary will deploy a keylogger to the user's system in one of many ways.

    Techniques
    Send a phishing email with a malicious attachment that installs a keylogger on a user's system
    Conceal a keylogger behind fake software and get the user to download the software
    Get a user to click on a malicious URL that directs them to a webpage that will install a keylogger without their knowledge
    Gain access to the user's system through a vulnerability and manually install a keylogger
  2. Record keystrokes: Once the keylogger is deployed on the user's system, the adversary will record keystrokes over a period of time.

  3. Analyze data and determine credentials: Using the captured keystrokes, the adversary will be able to determine the credentials of the user.

    Techniques
    Search for repeated sequences that are following by the enter key
    Search for repeated sequences that are not found in a dictionary
    Search for several backspaces in a row. This could indicate a mistyped password. The correct password can then be inferred using the whole key sequence
Exploit
  1. Use found credentials: After the adversary has found the credentials for the target user, they will then use them to gain access to a system in order to perform some follow-up attack

+ Prerequisites
The ability to install the keylogger, either in person or remote.
+ Mitigations
Strong physical security can help reduce the ability of an adversary to install a keylogger.
+ Taxonomy Mappings
Relevant to the ATT&CK taxonomy mapping (also see parent)
Entry IDEntry Name
1056.001Input Capture:Keylogging
+ Content History
Submissions
Submission DateSubmitterOrganization
2015-11-09
(Version 2.7)
CAPEC Content TeamThe MITRE Corporation
Modifications
Modification DateModifierOrganization
2018-07-31
(Version 2.12)
CAPEC Content TeamThe MITRE Corporation
Updated References
2020-07-30
(Version 3.3)
CAPEC Content TeamThe MITRE Corporation
Updated Related_Attack_Patterns, Taxonomy_Mappings
2020-12-17
(Version 3.4)
CAPEC Content TeamThe MITRE Corporation
Updated Related_Attack_Patterns
2021-10-21
(Version 3.6)
CAPEC Content TeamThe MITRE Corporation
Updated Execution_Flow
More information is available — Please select a different filter.
Page Last Updated or Reviewed: October 21, 2021