Detect GUI Input Capture in CrowdStrike LogScale
Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. This includes spoofing Windows UAC dialogs, macOS authentication prompts, or application-specific login windows using scripting languages such as PowerShell, AppleScript, or shell scripts. Threat actors leverage this technique to harvest credentials without exploiting technical vulnerabilities, instead relying on user trust in familiar UI elements. Real-world examples include Proton, Calisto, Keydnap, FIN4, and RedCurl using fake dialogs to steal credentials.
MITRE ATT&CK
- Tactic
- Collection Credential Access
- Technique
- T1056 Input Capture
- Sub-technique
- T1056.002 GUI Input Capture
- Canonical reference
- https://attack.mitre.org/techniques/T1056/002/
LogScale Detection Query
// GUI Input Capture — Credential Dialog Detection (T1056.002)
// Primary: credential prompt API invocations
#event_simpleName = "ProcessRollup2"
| ImageFileName = /(?i)(\\powershell\.exe|\\pwsh\.exe|\\mshta\.exe|\\wscript\.exe|\\cscript\.exe)$/
| CommandLine = /(?i)(get-credential|promptforcredential|credphish|credential.prompt|system\.windows\.forms|showdialog|loadwithpartialname|inputbox|microsoft\.visualbasic|visualbasic\.interaction|osascript|dialogbox)/i
| eval GetCredential = if(CommandLine = /(?i)(get-credential|promptforcredential|credphish)/, "1", "0")
| eval WinFormsDialog = if(CommandLine = /(?i)(system\.windows\.forms|showdialog|loadwithpartialname)/, "1", "0")
| eval VBInputBox = if(CommandLine = /(?i)(inputbox|microsoft\.visualbasic|visualbasic\.interaction)/, "1", "0")
| eval HiddenExecution = if(CommandLine = /(?i)(-windowstyle\s+hidden|-w\s+hidden|-noninteractive)/, "1", "0")
| eval SuspiciousParent = if(ParentBaseFileName = /(?i)(winword\.exe|excel\.exe|powerpnt\.exe|outlook\.exe|mshta\.exe|wscript\.exe|cscript\.exe|rundll32\.exe|regsvr32\.exe|chrome\.exe|firefox\.exe|msedge\.exe)/, "1", "0")
| eval CredPhishScore = toint(GetCredential) + toint(WinFormsDialog) + toint(VBInputBox) + toint(HiddenExecution) + toint(SuspiciousParent)
| eval PromptType = case(
GetCredential = "1", "Get-Credential / PromptForCredential",
WinFormsDialog = "1", "WinForms ShowDialog",
VBInputBox = "1", "VBScript InputBox",
true(), "Generic Credential Prompt"
)
| where CredPhishScore > 0
| fields timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, PromptType, GetCredential, WinFormsDialog, VBInputBox, HiddenExecution, SuspiciousParent, CredPhishScore
| sort(field=CredPhishScore, order=desc)
| sort(field=timestamp, order=desc)CrowdStrike LogScale (Falcon) query detecting GUI input capture (T1056.002) using ProcessRollup2 events. Identifies PowerShell, MSHTA, WScript, and CScript processes invoking credential dialog APIs. Scores each event across five behavioral dimensions and surfaces highest-risk events. Compatible with Falcon Insight XDR process telemetry.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike-managed endpoints running PowerShell-based endpoint deployment scripts that use Get-Credential to collect service account credentials during enterprise software provisioning
- Internal ITSM or helpdesk automation tools that invoke PowerShell WinForms dialogs for credential collection as part of approved password reset workflows
- Software testing frameworks (e.g., Pester, Selenium wrappers) that invoke credential dialog functions in CI/CD pipelines on developer workstations managed by Falcon
Other platforms for T1056.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Get-Credential Fake Authentication Prompt
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-Credential' and 'Out-File'. Sysmon Event ID 11: File Create for $env:TEMP\cred_capture_test.txt. PowerShell Script Block Log Event ID 4104 with the full credential capture code including the spoofed message text.
- Test 2PowerShell Windows Forms Dialog Credential Phishing
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'System.Windows.Forms', 'ShowDialog', '-WindowStyle Hidden', and 'PasswordChar'. PowerShell Script Block Log Event ID 4104 with the full WinForms credential dialog construction code. No file write occurs in this test unless modified.
- Test 3VBScript InputBox Credential Prompt via MSHTA
Expected signal: Sysmon Event ID 1: Process Create with Image=mshta.exe, CommandLine containing 'vbscript', 'InputBox', and 'password'. Sysmon Event ID 11: File Create for %TEMP%\vbs_cred_test.txt if the user enters text. Security Event ID 4688 (if command line auditing enabled) with mshta.exe and the vbscript URL scheme.
- Test 4PowerShell PromptForCredential via Host UI (Simulated UAC Spoof)
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing '$host.ui.PromptForCredential' and 'administrator credentials'. PowerShell Script Block Log Event ID 4104 captures the full command including the spoofed message text that mimics a UAC prompt. No network connection in this test.
References (12)
- https://attack.mitre.org/techniques/T1056/002/
- https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/
- https://enigma0x3.net/2015/01/21/phishing-for-credentials-if-you-want-it-just-ask/
- https://logrhythm.com/blog/do-you-trust-your-computer/
- https://github.com/byt3bl33d3r/SILENTTRINITY/blob/master/silenttrinity/modules/src/credphisher.py
- https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/
- https://baesystemsai.blogspot.com/2015/06/new-mac-os-malware-exploits-mackeeper.html
- https://www.fireeye.com/blog/threat-research/2014/11/fin4-stealing-insider-information.html
- https://www.symantec.com/blogs/threat-intelligence/calisto-mac-malware
- https://www.trendmicro.com/en_us/research/20/h/xcsset-mac-malware--infects-xcode-projects--uses-0-days.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.002/T1056.002.md
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-credential
Unlock Pro Content
Get the full detection package for T1056.002 including response playbook, investigation guide, and atomic red team tests.