Detect GUI Input Capture in Microsoft Sentinel
Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. This includes spoofing Windows UAC dialogs, macOS authentication prompts, or application-specific login windows using scripting languages such as PowerShell, AppleScript, or shell scripts. Threat actors leverage this technique to harvest credentials without exploiting technical vulnerabilities, instead relying on user trust in familiar UI elements. Real-world examples include Proton, Calisto, Keydnap, FIN4, and RedCurl using fake dialogs to steal credentials.
MITRE ATT&CK
- Tactic
- Collection Credential Access
- Technique
- T1056 Input Capture
- Sub-technique
- T1056.002 GUI Input Capture
- Canonical reference
- https://attack.mitre.org/techniques/T1056/002/
KQL Detection Query
let CredPhishPatterns = dynamic([
"PromptForCredential",
"Get-Credential",
"credphish",
"credential prompt",
"DialogBox",
"WinForms",
"System.Windows.Forms",
"[System.Reflection.Assembly]::LoadWithPartialName",
"ShowDialog",
"InputBox",
"VisualBasic.Interaction",
"Microsoft.VisualBasic",
"osascript"
]);
let SuspiciousParents = dynamic([
"wscript.exe", "cscript.exe", "mshta.exe",
"rundll32.exe", "regsvr32.exe",
"winword.exe", "excel.exe", "powerpnt.exe",
"outlook.exe", "msedge.exe", "chrome.exe", "firefox.exe"
]);
// PowerShell-based credential prompt detection
let PSCredPrompt = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (CredPhishPatterns)
| extend PromptType = case(
ProcessCommandLine has "Get-Credential", "Get-Credential API",
ProcessCommandLine has "PromptForCredential", "Host.PromptForCredential",
ProcessCommandLine has "System.Windows.Forms", "WinForms Dialog",
ProcessCommandLine has "VisualBasic", "VB InputBox",
ProcessCommandLine has "ShowDialog", "WPF/WinForms ShowDialog",
"Unknown Prompt Pattern"
)
| extend SuspiciousParent = InitiatingProcessFileName has_any (SuspiciousParents)
| extend HiddenExecution = ProcessCommandLine has_any ("-WindowStyle Hidden", "-w hidden", "-NonInteractive")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
PromptType, SuspiciousParent, HiddenExecution
| extend Source = "PowerShell";
// cmd/wscript-based dialog prompt detection (mshta, VBScript InputBox)
let ScriptCredPrompt = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("mshta.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any ("InputBox", "PromptForCredential", "PasswordInputPrompt", "credential", "password")
| extend PromptType = "Script-based InputBox"
| extend SuspiciousParent = InitiatingProcessFileName has_any (SuspiciousParents)
| extend HiddenExecution = false
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
PromptType, SuspiciousParent, HiddenExecution
| extend Source = "Script";
// Union results
PSCredPrompt
| union ScriptCredPrompt
| sort by Timestamp descDetects GUI-based credential prompt spoofing via PowerShell, WScript, CScript, and MSHTA. Identifies use of Get-Credential, PromptForCredential, Windows Forms dialogs, VBScript InputBox, and ShowDialog calls commonly used to present fake authentication prompts to users. Also flags execution from suspicious parent processes (Office applications, browsers) which may indicate a malicious macro or extension triggering a credential phishing dialog.
Data Sources
Required Tables
False Positives & Tuning
- IT helpdesk scripts using Get-Credential to prompt administrators for credentials during legitimate remote management tasks
- Software installers that use PowerShell PromptForCredential to request elevated permissions before performing system changes
- Internal developer tools or automation platforms that use Windows Forms dialogs to collect configuration input from operators
- Password management applications that use ShowDialog or similar APIs as part of their legitimate credential management UI
Other platforms for T1056.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Get-Credential Fake Authentication Prompt
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-Credential' and 'Out-File'. Sysmon Event ID 11: File Create for $env:TEMP\cred_capture_test.txt. PowerShell Script Block Log Event ID 4104 with the full credential capture code including the spoofed message text.
- Test 2PowerShell Windows Forms Dialog Credential Phishing
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'System.Windows.Forms', 'ShowDialog', '-WindowStyle Hidden', and 'PasswordChar'. PowerShell Script Block Log Event ID 4104 with the full WinForms credential dialog construction code. No file write occurs in this test unless modified.
- Test 3VBScript InputBox Credential Prompt via MSHTA
Expected signal: Sysmon Event ID 1: Process Create with Image=mshta.exe, CommandLine containing 'vbscript', 'InputBox', and 'password'. Sysmon Event ID 11: File Create for %TEMP%\vbs_cred_test.txt if the user enters text. Security Event ID 4688 (if command line auditing enabled) with mshta.exe and the vbscript URL scheme.
- Test 4PowerShell PromptForCredential via Host UI (Simulated UAC Spoof)
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing '$host.ui.PromptForCredential' and 'administrator credentials'. PowerShell Script Block Log Event ID 4104 captures the full command including the spoofed message text that mimics a UAC prompt. No network connection in this test.
References (12)
- https://attack.mitre.org/techniques/T1056/002/
- https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/
- https://enigma0x3.net/2015/01/21/phishing-for-credentials-if-you-want-it-just-ask/
- https://logrhythm.com/blog/do-you-trust-your-computer/
- https://github.com/byt3bl33d3r/SILENTTRINITY/blob/master/silenttrinity/modules/src/credphisher.py
- https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/
- https://baesystemsai.blogspot.com/2015/06/new-mac-os-malware-exploits-mackeeper.html
- https://www.fireeye.com/blog/threat-research/2014/11/fin4-stealing-insider-information.html
- https://www.symantec.com/blogs/threat-intelligence/calisto-mac-malware
- https://www.trendmicro.com/en_us/research/20/h/xcsset-mac-malware--infects-xcode-projects--uses-0-days.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.002/T1056.002.md
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-credential
Unlock Pro Content
Get the full detection package for T1056.002 including response playbook, investigation guide, and atomic red team tests.