Detect Input Capture in CrowdStrike LogScale
Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture). Common sub-techniques include keylogging via Windows hooks (SetWindowsHookEx), GUI input capture via credential dialog spoofing, web portal capture via fake login pages, and credential API hooking via DLL injection into authentication processes. Threat actors including APT42, Storm-1811, and APT39 have leveraged these techniques, as have malware families such as InvisibleFerret, Chaes, Kobalos, and NPPSPY.
MITRE ATT&CK
- Tactic
- Collection Credential Access
- Technique
- T1056 Input Capture
- Canonical reference
- https://attack.mitre.org/techniques/T1056/
LogScale Detection Query
// T1056 Input Capture — CrowdStrike LogScale / Falcon CQL
// Multi-signal detection covering NPPSPY, DLL injection, keylogger APIs, remote thread
// Signal 1: Network Provider Registry Modification (RegistryOperationEvent)
#event_simpleName = "RegistryOperationEvent"
| RegObjectName = /(?i)(SYSTEM\CurrentControlSet\Control\NetworkProvider\Order|SYSTEM\CurrentControlSet\Services\.*\NetworkProvider)/
| ProcessImageFileName != /(?i)(services\.exe|svchost\.exe|msiexec\.exe|TrustedInstaller\.exe)$/
| eval SignalType="NetworkProviderRegistration", SeverityScore=90
| table([_time, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, ProcessImageFileName, CommandLine, SignalType, SeverityScore])
// Signal 2: Suspicious DLL Load into Credential Process (ClassifiedModuleLoad or ImageLoad)
#event_simpleName = /ClassifiedModuleLoad|LoadedModule/
| TargetProcessImageFileName = /(?i)(winlogon\.exe|lsass\.exe|LogonUI\.exe|consent\.exe|credui\.exe)$/
| ImageFileName != /(?i)^(C:\Windows\System32\|C:\Windows\SysWOW64\|C:\Program Files\|C:\Program Files \(x86\)\)/
| ImageFileName = /(?i)\.dll$/
| eval SignalType="SuspiciousDLLInCredentialProcess", SeverityScore=85
| table([_time, ComputerName, UserName, TargetProcessImageFileName, ImageFileName, MD5HashData, SHA256HashData, SignalType, SeverityScore])
// Signal 3: Input Capture API or Tool Invocation (ProcessRollup2)
#event_simpleName = "ProcessRollup2"
| CommandLine = /(?i)(SetWindowsHookEx|GetAsyncKeyState|GetKeyState|WH_KEYBOARD_LL|WH_MOUSE_LL|pyWinhook|pynput|Get-Clipboard|keyboard\.hook|InputCapture)/
OR ImageFileName = /(?i)(keylog|keyscan|hookdll|inputcap|credcap)/
| eval SignalType="InputCaptureAPIOrTool", SeverityScore=70
| table([_time, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, SignalType, SeverityScore])
// Signal 4: Remote Thread into Credential Process (CreateRemoteThreadApiCall)
#event_simpleName = "CreateRemoteThreadApiCall"
| TargetProcessImageFileName = /(?i)(winlogon\.exe|LogonUI\.exe|credui\.exe|consent\.exe)$/
| eval SignalType="RemoteThreadInCredentialProcess", SeverityScore=95
| table([_time, ComputerName, UserName, ContextProcessImageFileName, TargetProcessImageFileName, StartAddress, SignalType, SeverityScore])
// Aggregated hunting query — all signals by host with counts over 24h
#event_simpleName = /ProcessRollup2|RegistryOperationEvent|ClassifiedModuleLoad|CreateRemoteThreadApiCall/
| case {
#event_simpleName = "RegistryOperationEvent"
AND RegObjectName = /(?i)(NetworkProvider)/
AND ProcessImageFileName != /(?i)(services\.exe|svchost\.exe|msiexec\.exe)$/
=> SignalType := "NetworkProviderReg" ;
#event_simpleName = /ClassifiedModuleLoad|LoadedModule/
AND TargetProcessImageFileName = /(?i)(winlogon\.exe|lsass\.exe|LogonUI\.exe|consent\.exe|credui\.exe)$/
AND ImageFileName != /(?i)^C:\Windows\\/
=> SignalType := "SuspiciousDLLLoad" ;
#event_simpleName = "ProcessRollup2"
AND (CommandLine = /(?i)(SetWindowsHookEx|GetAsyncKeyState|WH_KEYBOARD_LL|pyWinhook|pynput)/
OR ImageFileName = /(?i)(keylog|keyscan|hookdll)/)
=> SignalType := "InputCaptureAPI" ;
#event_simpleName = "CreateRemoteThreadApiCall"
AND TargetProcessImageFileName = /(?i)(winlogon\.exe|LogonUI\.exe|credui\.exe|consent\.exe)$/
=> SignalType := "RemoteThreadCredProc" ;
* => drop()
}
| groupBy([ComputerName, SignalType], function=[count(as=EventCount), collect([UserName, ImageFileName, CommandLine], limit=5)])
| sort(SeverityScore, order=desc)CrowdStrike LogScale CQL multi-signal detection for T1056 Input Capture. Uses Falcon telemetry event types: RegistryOperationEvent for NPPSPY-style Network Provider DLL registration, ClassifiedModuleLoad/LoadedModule for suspicious DLL injection into credential processes, ProcessRollup2 for input capture API strings and keylogger tool names in process command lines, and CreateRemoteThreadApiCall for remote thread injection into authentication processes. Includes an aggregation hunting query grouping all signal types by host.
Data Sources
Required Tables
False Positives & Tuning
- CrowdStrike sensor itself generates ClassifiedModuleLoad events when loading its own monitoring DLLs into system processes — will appear in telemetry but with known Falcon-signed hashes
- VPN client installation (GlobalProtect, Cisco AnyConnect, Pulse Secure) creates RegistryOperationEvent hits on NetworkProvider keys via non-standard installer child processes
- Sysmon installation or configuration update may spawn processes matching input capture patterns when loading driver components
- Windows Subsystem for Linux (WSL) components may trigger clipboard API detections when using cross-environment clipboard sharing
- Software development environments with debugging tools attached to winlogon.exe for testing credential providers will generate DLL load and remote thread signals
Other platforms for T1056
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1NPPSPY Network Provider Registration (Credential Interception Setup)
Expected signal: Sysmon Event ID 12 (RegistryKeyCreate): TargetObject containing HKLM\SYSTEM\CurrentControlSet\Services\TestNPP. Sysmon Event ID 13 (RegistryValueSet): TargetObject containing NetworkProvider\Order with Details showing 'TestNPP' appended to ProviderOrder. Security Event ID 4657 (Registry value modification) if object access auditing is enabled. MDE DeviceRegistryEvents with ActionType=RegistryKeyCreated and RegistryKeyCreated for both the service key and NetworkProvider\Order.
- Test 2Low-Level Keyboard Hook via PowerShell PInvoke (SetWindowsHookEx WH_KEYBOARD_LL)
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'SetWindowsHookEx', 'WH_KEYBOARD_LL' or value '13', and 'Add-Type'. PowerShell ScriptBlock Log Event ID 4104 with the full PInvoke code including SetWindowsHookEx. MDE DeviceProcessEvents with ProcessCommandLine matching SetWindowsHookEx pattern.
- Test 3Clipboard Monitoring Loop with File Exfiltration Simulation
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-Clipboard', 'while', 'Start-Sleep', 'Add-Content', '-WindowStyle Hidden'. Sysmon Event ID 11 (File Create): cb_harvest.txt created in %TEMP%. MDE DeviceProcessEvents with ProcessCommandLine matching clipboard + loop pattern. MDE DeviceFileEvents showing file writes to TEMP directory.
- Test 4SSH Client Trojanization Simulation (Kobalos Pattern — Linux)
Expected signal: Auditd: file modification events on /usr/bin/ssh binary (syscall=rename or write). Syslog: file integrity monitoring alerts if AIDE/Tripwire/OSSEC is configured. If Linux auditd with file watches configured: SYSCALL records for rename/unlink on /usr/bin/ssh. Process execution telemetry showing /usr/bin/ssh spawning /tmp/ssh_real as child process. File creation event for /tmp/.ssh_capture.log.
- Test 5Python Keylogger via pynput (Cross-Platform)
Expected signal: Sysmon Event ID 1: Process Create for pip.exe (pynput installation) and python.exe (keylogger execution). CommandLine of python.exe containing 'pynput', 'keyboard', 'Listener', 'on_press'. Sysmon Event ID 7: Image loads for pynput DLL dependencies into python.exe. Network connection (Sysmon Event ID 3) from pip.exe to PyPI for package download during installation phase. MDE DeviceProcessEvents capturing both pip and python command lines.
References (14)
- https://attack.mitre.org/techniques/T1056/
- https://attack.mitre.org/techniques/T1056/001/
- https://attack.mitre.org/techniques/T1056/002/
- https://attack.mitre.org/techniques/T1056/003/
- https://attack.mitre.org/techniques/T1056/004/
- https://www.huntress.com/blog/credential-interception-via-nppspy
- https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowshookexw
- https://www.welivesecurity.com/2021/01/26/kobalos-complex-linux-threat-high-performance-computing-infrastructure/
- https://unit42.paloaltonetworks.com/contagious-interview-beavertail-invisibleferret/
- https://www.sentinelone.com/labs/metador-technical-appendix/
- https://www.cybereason.com/blog/research/chaes-hunting-the-prey
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.001/T1056.001.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_credentials_stealing_via_network_provider.yml
- http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf
Unlock Pro Content
Get the full detection package for T1056 including response playbook, investigation guide, and atomic red team tests.