Detect GUI Input Capture in Splunk
Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. This includes spoofing Windows UAC dialogs, macOS authentication prompts, or application-specific login windows using scripting languages such as PowerShell, AppleScript, or shell scripts. Threat actors leverage this technique to harvest credentials without exploiting technical vulnerabilities, instead relying on user trust in familiar UI elements. Real-world examples include Proton, Calisto, Keydnap, FIN4, and RedCurl using fake dialogs to steal credentials.
MITRE ATT&CK
- Tactic
- Collection Credential Access
- Technique
- T1056 Input Capture
- Sub-technique
- T1056.002 GUI Input Capture
- Canonical reference
- https://attack.mitre.org/techniques/T1056/002/
SPL Detection Query
index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1)
(Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\mshta.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe")
| eval CommandLine=lower(CommandLine)
| eval GetCredential=if(match(CommandLine, "(get-credential|promptforcredential|credphish)"), 1, 0)
| eval WinFormsDialog=if(match(CommandLine, "(system\.windows\.forms|showdialog|winforms|loadwithpartialname)"), 1, 0)
| eval VBInputBox=if(match(CommandLine, "(inputbox|microsoft\.visualbasic|visualbasic\.interaction)"), 1, 0)
| eval HiddenExecution=if(match(CommandLine, "(-windowstyle\s+hidden|-w\s+hidden|-noninteractive)"), 1, 0)
| eval SuspiciousParent=if(match(lower(ParentImage), "(winword\.exe|excel\.exe|powerpnt\.exe|outlook\.exe|mshta\.exe|wscript\.exe|cscript\.exe|rundll32\.exe|regsvr32\.exe|chrome\.exe|firefox\.exe|msedge\.exe)"), 1, 0)
| eval CredPhishScore=GetCredential + WinFormsDialog + VBInputBox + HiddenExecution + SuspiciousParent
| where CredPhishScore > 0
| eval PromptType=case(
GetCredential=1, "Get-Credential / PromptForCredential",
WinFormsDialog=1, "WinForms ShowDialog",
VBInputBox=1, "VBScript InputBox",
1=1, "Generic Credential Prompt"
)
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, PromptType, GetCredential, WinFormsDialog, VBInputBox, HiddenExecution, SuspiciousParent, CredPhishScore
| sort - CredPhishScore, - _timeDetects GUI-based credential phishing prompts using Sysmon Event ID 1. Scores each event across multiple dimensions: Get-Credential / PromptForCredential API usage, Windows Forms dialog creation, VBScript InputBox calls, hidden execution flags, and suspicious parent processes (Office apps, browsers, script hosts). A higher CredPhishScore indicates more overlap with known phishing prompt patterns and should be prioritized for review.
Data Sources
Required Sourcetypes
False Positives & Tuning
- IT helpdesk scripts using Get-Credential to prompt administrators for credentials during legitimate remote management tasks
- Software installers that use PowerShell PromptForCredential to request elevated permissions before performing system changes
- Internal developer tools or automation platforms that use Windows Forms dialogs to collect configuration input from operators
- Password management applications that use ShowDialog or similar APIs as part of their legitimate credential management UI
Other platforms for T1056.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Get-Credential Fake Authentication Prompt
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-Credential' and 'Out-File'. Sysmon Event ID 11: File Create for $env:TEMP\cred_capture_test.txt. PowerShell Script Block Log Event ID 4104 with the full credential capture code including the spoofed message text.
- Test 2PowerShell Windows Forms Dialog Credential Phishing
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'System.Windows.Forms', 'ShowDialog', '-WindowStyle Hidden', and 'PasswordChar'. PowerShell Script Block Log Event ID 4104 with the full WinForms credential dialog construction code. No file write occurs in this test unless modified.
- Test 3VBScript InputBox Credential Prompt via MSHTA
Expected signal: Sysmon Event ID 1: Process Create with Image=mshta.exe, CommandLine containing 'vbscript', 'InputBox', and 'password'. Sysmon Event ID 11: File Create for %TEMP%\vbs_cred_test.txt if the user enters text. Security Event ID 4688 (if command line auditing enabled) with mshta.exe and the vbscript URL scheme.
- Test 4PowerShell PromptForCredential via Host UI (Simulated UAC Spoof)
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing '$host.ui.PromptForCredential' and 'administrator credentials'. PowerShell Script Block Log Event ID 4104 captures the full command including the spoofed message text that mimics a UAC prompt. No network connection in this test.
References (12)
- https://attack.mitre.org/techniques/T1056/002/
- https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/
- https://enigma0x3.net/2015/01/21/phishing-for-credentials-if-you-want-it-just-ask/
- https://logrhythm.com/blog/do-you-trust-your-computer/
- https://github.com/byt3bl33d3r/SILENTTRINITY/blob/master/silenttrinity/modules/src/credphisher.py
- https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/
- https://baesystemsai.blogspot.com/2015/06/new-mac-os-malware-exploits-mackeeper.html
- https://www.fireeye.com/blog/threat-research/2014/11/fin4-stealing-insider-information.html
- https://www.symantec.com/blogs/threat-intelligence/calisto-mac-malware
- https://www.trendmicro.com/en_us/research/20/h/xcsset-mac-malware--infects-xcode-projects--uses-0-days.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.002/T1056.002.md
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-credential
Unlock Pro Content
Get the full detection package for T1056.002 including response playbook, investigation guide, and atomic red team tests.