ATT&CK technique
View on MITRE ATT&CK →
T1056
Input Capture
CollectionCredential Access
7 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Potential Sudo Hijacking | production | 2026-09-18 |
| elastic | Prompt for Credentials with Osascript | production | 2026-09-18 |
| elastic | PowerShell Keylogging Script | production | 2026-09-18 |
| elastic | Potential SSH Password Grabbing via strace | production | 2026-09-18 |
| elastic | Suspicious pbpaste High Volume Activity | production | 2026-09-18 |
| sigma | DNS Query Request To OneLaunch Update Service | test | 2024-02-26 |
| sigma | Suspicious Network Communication With IPFS | test | 2023-03-16 |