ATT&CK technique
View on MITRE ATT&CK →
T1056.002
GUI Input Capture
CollectionCredential Access
6 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | MacOS Osascript Displaying Suspicious User Prompt | production | 2026-10-02 |
| splunk | Windows Input Capture Using Credential UI Dll | production | 2026-10-02 |
| elastic | Prompt for Credentials with Osascript | production | 2026-09-18 |
| sigma | CredUI.DLL Loaded By Uncommon Process | test | 2026-06-29 |
| sigma | GUI Input Capture - macOS | test | 2025-12-05 |
| sigma | PUA - Mouse Lock Execution | test | 2023-02-21 |