Detect GUI Input Capture in Elastic Security
Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. This includes spoofing Windows UAC dialogs, macOS authentication prompts, or application-specific login windows using scripting languages such as PowerShell, AppleScript, or shell scripts. Threat actors leverage this technique to harvest credentials without exploiting technical vulnerabilities, instead relying on user trust in familiar UI elements. Real-world examples include Proton, Calisto, Keydnap, FIN4, and RedCurl using fake dialogs to steal credentials.
MITRE ATT&CK
- Tactic
- Collection Credential Access
- Technique
- T1056 Input Capture
- Sub-technique
- T1056.002 GUI Input Capture
- Canonical reference
- https://attack.mitre.org/techniques/T1056/002/
Elastic Detection Query
sequence by host.name with maxspan=5m
[process where event.type == "start" and
process.name in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe") and
(
process.args : ("*Get-Credential*", "*PromptForCredential*", "*credphish*", "*credential prompt*") or
process.args : ("*System.Windows.Forms*", "*ShowDialog*", "*WinForms*", "*LoadWithPartialName*") or
process.args : ("*InputBox*", "*Microsoft.VisualBasic*", "*VisualBasic.Interaction*") or
process.args : ("*osascript*", "*DialogBox*")
)
] by process.entity_id
OR
process where event.type == "start" and
process.name in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe") and
(
process.args : ("*Get-Credential*", "*PromptForCredential*", "*credphish*") or
process.args : ("*System.Windows.Forms*", "*ShowDialog*", "*WinForms*", "*LoadWithPartialName*") or
process.args : ("*InputBox*", "*Microsoft.VisualBasic*", "*VisualBasic.Interaction*")
) and
process.parent.name in~ ("winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "mshta.exe",
"wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe",
"chrome.exe", "firefox.exe", "msedge.exe")Detects GUI input capture via fake credential dialogs by identifying PowerShell, MSHTA, WScript, or CScript processes invoking credential prompt APIs (Get-Credential, PromptForCredential, WinForms ShowDialog, VBScript InputBox) or spawning from suspicious parent processes such as Office applications and browsers. Maps to MITRE ATT&CK T1056.002.
Data Sources
Required Tables
False Positives & Tuning
- IT administrators using PowerShell scripts with Get-Credential for legitimate credential collection in automation pipelines or deployment scripts
- Security tools and password managers that use WinForms dialogs to collect credentials for vault storage
- Developer tools or IDE plugins that spawn PowerShell with Windows Forms dialogs for configuration wizards
Other platforms for T1056.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Get-Credential Fake Authentication Prompt
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-Credential' and 'Out-File'. Sysmon Event ID 11: File Create for $env:TEMP\cred_capture_test.txt. PowerShell Script Block Log Event ID 4104 with the full credential capture code including the spoofed message text.
- Test 2PowerShell Windows Forms Dialog Credential Phishing
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'System.Windows.Forms', 'ShowDialog', '-WindowStyle Hidden', and 'PasswordChar'. PowerShell Script Block Log Event ID 4104 with the full WinForms credential dialog construction code. No file write occurs in this test unless modified.
- Test 3VBScript InputBox Credential Prompt via MSHTA
Expected signal: Sysmon Event ID 1: Process Create with Image=mshta.exe, CommandLine containing 'vbscript', 'InputBox', and 'password'. Sysmon Event ID 11: File Create for %TEMP%\vbs_cred_test.txt if the user enters text. Security Event ID 4688 (if command line auditing enabled) with mshta.exe and the vbscript URL scheme.
- Test 4PowerShell PromptForCredential via Host UI (Simulated UAC Spoof)
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing '$host.ui.PromptForCredential' and 'administrator credentials'. PowerShell Script Block Log Event ID 4104 captures the full command including the spoofed message text that mimics a UAC prompt. No network connection in this test.
References (12)
- https://attack.mitre.org/techniques/T1056/002/
- https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/
- https://enigma0x3.net/2015/01/21/phishing-for-credentials-if-you-want-it-just-ask/
- https://logrhythm.com/blog/do-you-trust-your-computer/
- https://github.com/byt3bl33d3r/SILENTTRINITY/blob/master/silenttrinity/modules/src/credphisher.py
- https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/
- https://baesystemsai.blogspot.com/2015/06/new-mac-os-malware-exploits-mackeeper.html
- https://www.fireeye.com/blog/threat-research/2014/11/fin4-stealing-insider-information.html
- https://www.symantec.com/blogs/threat-intelligence/calisto-mac-malware
- https://www.trendmicro.com/en_us/research/20/h/xcsset-mac-malware--infects-xcode-projects--uses-0-days.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.002/T1056.002.md
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-credential
Unlock Pro Content
Get the full detection package for T1056.002 including response playbook, investigation guide, and atomic red team tests.