Detect GUI Input Capture in Sumo Logic CSE
Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. This includes spoofing Windows UAC dialogs, macOS authentication prompts, or application-specific login windows using scripting languages such as PowerShell, AppleScript, or shell scripts. Threat actors leverage this technique to harvest credentials without exploiting technical vulnerabilities, instead relying on user trust in familiar UI elements. Real-world examples include Proton, Calisto, Keydnap, FIN4, and RedCurl using fake dialogs to steal credentials.
MITRE ATT&CK
- Tactic
- Collection Credential Access
- Technique
- T1056 Input Capture
- Sub-technique
- T1056.002 GUI Input Capture
- Canonical reference
- https://attack.mitre.org/techniques/T1056/002/
Sumo Detection Query
(_sourceCategory="windows/sysmon" OR _sourceCategory="windows/security")
| where EventID = "1" OR EventID = "4688"
| where (process_name matches /(?i)(powershell\.exe|pwsh\.exe|mshta\.exe|wscript\.exe|cscript\.exe)/)
| where (
command_line matches /(?i)(get-credential|promptforcredential|credphish|credential.prompt)/ OR
command_line matches /(?i)(system\.windows\.forms|showdialog|winforms|loadwithpartialname)/ OR
command_line matches /(?i)(inputbox|microsoft\.visualbasic|visualbasic\.interaction)/ OR
command_line matches /(?i)(osascript|dialogbox)/
)
| eval get_credential = if(command_line matches /(?i)(get-credential|promptforcredential|credphish)/, 1, 0)
| eval winforms_dialog = if(command_line matches /(?i)(system\.windows\.forms|showdialog|loadwithpartialname)/, 1, 0)
| eval vb_inputbox = if(command_line matches /(?i)(inputbox|microsoft\.visualbasic|visualbasic\.interaction)/, 1, 0)
| eval hidden_execution = if(command_line matches /(?i)(-windowstyle\s+hidden|-w\s+hidden|-noninteractive)/, 1, 0)
| eval suspicious_parent = if(parent_process matches /(?i)(winword\.exe|excel\.exe|powerpnt\.exe|outlook\.exe|mshta\.exe|wscript\.exe|cscript\.exe|rundll32\.exe|regsvr32\.exe|chrome\.exe|firefox\.exe|msedge\.exe)/, 1, 0)
| eval credphish_score = get_credential + winforms_dialog + vb_inputbox + hidden_execution + suspicious_parent
| where credphish_score > 0
| eval prompt_type = if(get_credential = 1, "Get-Credential/PromptForCredential",
if(winforms_dialog = 1, "WinForms ShowDialog",
if(vb_inputbox = 1, "VBScript InputBox", "Generic Credential Prompt")))
| fields _messagetime, host, user, process_name, command_line, parent_process, prompt_type, get_credential, winforms_dialog, vb_inputbox, hidden_execution, suspicious_parent, credphish_score
| sort by credphish_score desc, _messagetime descSumo Logic query detecting GUI input capture (T1056.002) by identifying scripting processes invoking credential prompt APIs. Scores each event across five behavioral indicators — Get-Credential/PromptForCredential use, WinForms dialog invocations, VBScript InputBox calls, hidden execution flags, and suspicious parent processes — and surfaces the highest-risk events first.
Data Sources
Required Tables
False Positives & Tuning
- PowerShell-based onboarding or HR systems that display Get-Credential prompts to collect initial Active Directory credentials for new employee accounts
- Security awareness training platforms that simulate phishing scenarios using WinForms dialogs as part of controlled exercises
- Monitoring and observability agents that use WinForms or PowerShell dialogs for interactive configuration during initial setup on managed endpoints
Other platforms for T1056.002
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Get-Credential Fake Authentication Prompt
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-Credential' and 'Out-File'. Sysmon Event ID 11: File Create for $env:TEMP\cred_capture_test.txt. PowerShell Script Block Log Event ID 4104 with the full credential capture code including the spoofed message text.
- Test 2PowerShell Windows Forms Dialog Credential Phishing
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'System.Windows.Forms', 'ShowDialog', '-WindowStyle Hidden', and 'PasswordChar'. PowerShell Script Block Log Event ID 4104 with the full WinForms credential dialog construction code. No file write occurs in this test unless modified.
- Test 3VBScript InputBox Credential Prompt via MSHTA
Expected signal: Sysmon Event ID 1: Process Create with Image=mshta.exe, CommandLine containing 'vbscript', 'InputBox', and 'password'. Sysmon Event ID 11: File Create for %TEMP%\vbs_cred_test.txt if the user enters text. Security Event ID 4688 (if command line auditing enabled) with mshta.exe and the vbscript URL scheme.
- Test 4PowerShell PromptForCredential via Host UI (Simulated UAC Spoof)
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing '$host.ui.PromptForCredential' and 'administrator credentials'. PowerShell Script Block Log Event ID 4104 captures the full command including the spoofed message text that mimics a UAC prompt. No network connection in this test.
References (12)
- https://attack.mitre.org/techniques/T1056/002/
- https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/
- https://enigma0x3.net/2015/01/21/phishing-for-credentials-if-you-want-it-just-ask/
- https://logrhythm.com/blog/do-you-trust-your-computer/
- https://github.com/byt3bl33d3r/SILENTTRINITY/blob/master/silenttrinity/modules/src/credphisher.py
- https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/
- https://baesystemsai.blogspot.com/2015/06/new-mac-os-malware-exploits-mackeeper.html
- https://www.fireeye.com/blog/threat-research/2014/11/fin4-stealing-insider-information.html
- https://www.symantec.com/blogs/threat-intelligence/calisto-mac-malware
- https://www.trendmicro.com/en_us/research/20/h/xcsset-mac-malware--infects-xcode-projects--uses-0-days.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.002/T1056.002.md
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-credential
Unlock Pro Content
Get the full detection package for T1056.002 including response playbook, investigation guide, and atomic red team tests.