Threat intelligence / Technique

Keylogging

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.(Citation: Talos Kimsuky Nov 2021) Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes.(Citation: Adventures of a Keystroke) Some methods include: * Hooking API callbacks used for processing keystrokes. Unlike [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004), this focuses solely on API functions intended for processing keystroke data. * Reading raw keystroke data from the hardware buffer. * Windows Registry modifications. * Custom drivers. * [Modify System Image](https://attack.mitre.org/techniques/T1601) may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.(Citation: Cisco Blog Legacy Device Attacks)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

157 recorded

Relationships

mapped-to

from Capture Credentials via Keylogger

Technique

subtechnique-of

to Input Capture

Technique

uses

from 2015 Ukraine Electric Power Attack

Campaign

uses

from ADVSTORESHELL

Malware

uses

from Agent Tesla

Malware

uses

from Ajax Security Team

Group

uses

from AppleSeed

Malware

uses

from APT28

Group

uses

from APT3

Group

uses

from APT32

Group

uses

from APT38

Group

uses

from APT39

Group

uses

from APT41

Group

uses

from APT42

Group

uses

from APT5

Group

uses

from Astaroth

Malware

uses

from AsyncRAT

Tool

uses

from Attor

Malware

uses

from BabyShark

Malware

uses

from BADNEWS

Malware

uses

from BadPatch

Malware

uses

from Bandook

Malware

uses

from BISCUIT

Malware

uses

from BlackEnergy

Malware

uses

from BOOKWORM

Malware

uses

from Cadelspy

Malware

uses

from Carbanak

Malware

uses

from Cardinal RAT

Malware

uses

from Catchamas

Malware

uses

from CHIMNEYSWEEP

Malware

uses

from CHOPSTICK

Malware

uses

from Clambling

Malware

uses

from Cobalt Strike

Malware

uses

from Cobian RAT

Malware

uses

from CorKLOG

Malware

uses

from CosmicDuke

Malware

uses

from Crimson

Malware

uses

from Cuba

Malware

uses

from Cutting Edge

Campaign

uses

from DarkComet

Malware

uses

from DarkGate

Malware

uses

from Darkhotel

Group

uses

from DarkTortilla

Malware

uses

from DarkWatchman

Malware

uses

from Daserf

Malware

uses

from DCRAT

Tool

uses

from Derusbi

Malware

uses

from DOGCALL

Malware

uses

from DRYHOOK

Malware

uses

from Dtrack

Malware

uses

from Duqu

Malware

uses

from DUSTTRAP

Malware

uses

from DustySky

Malware

uses

from ECCENTRICBANDWAGON

Malware

uses

from Empire

Tool

uses

from EvilGrab

Malware

uses

from Explosive

Malware

uses

from FakeM

Malware

uses

from FIN13

Group

uses

from FIN4

Group

uses

from FlawedAmmyy

Malware

uses

from FunnyDream

Malware

uses

from Fysbis

Malware

uses

from gh0st RAT

Malware

uses

from Grandoreiro

Malware

uses

from GreyEnergy

Malware

uses

from Group5

Group

uses

from Helminth

Malware

uses

from HEXANE

Group

uses

from HexEval Loader

Malware

uses

from HTTPBrowser

Malware

uses

from Imminent Monitor

Tool

uses

from InvisibleFerret

Malware

uses

from InvisiMole

Malware

uses

from JPIN

Malware

uses

from jRAT

Malware

uses

from Kasidet

Malware

uses

from Ke3chang

Group

uses

from KeyBoy

Malware

uses

from KGH_SPY

Malware

uses

from Kimsuky

Group

uses

from Kivars

Malware

uses

from KONNI

Malware

uses

from Lazarus Group

Group

uses

from LODEINFO

Malware

uses

from Lokibot

Malware

uses

from Machete

Malware

uses

from MacMa

Malware

uses

from MacSpy

Malware

uses

from Magic Hound

Group

uses

from MarkiRAT

Malware

uses

from Matryoshka

Malware

uses

from menuPass

Group

uses

from metaMain

Malware

uses

from Metamorfo

Malware

uses

from MgBot

Malware

uses

from Micropsia

Malware

uses

from Mispadu

Malware

uses

from MoonWind

Malware

uses

from NanoCore

Malware

uses

from NavRAT

Malware

uses

from NetTraveler

Malware

uses

from NETWIRE

Malware

uses

from NightClub

Malware

uses

from njRAT

Malware

uses

from OilRig

Group

uses

from Okrum

Malware

uses

from Operation Wocao

Campaign

uses

from OwaAuth

Malware

uses

from PAKLOG

Malware

uses

from PcShare

Tool

uses

from Peppy

Malware

uses

from PLATINUM

Group

uses

from PlugX

Malware

uses

from PoetRAT

Malware

uses

from PoisonIvy

Malware

uses

from PoshC2

Tool

uses

from PowerLess

Malware

uses

from PowerSploit

Tool

uses

from Prikormka

Malware

uses

from Proton

Malware

uses

from Pupy

Tool

uses

from QakBot

Malware

uses

from QuasarRAT

Tool

uses

from RCSession

Malware

uses

from Regin

Malware

uses

from Remcos

Tool

uses

from Remexi

Malware

uses

from Remsec

Malware

uses

from Revenge RAT

Malware

uses

from ROKRAT

Malware

uses

from Rover

Malware

uses

from RTM

Malware

uses

from RunningRAT

Malware

uses

from Sandworm Team

Group

uses

from SILENTTRINITY

Tool

uses

from SLOTHFULMEDIA

Malware

uses

from SMOKEDHAM

Malware

uses

from Sowbug

Group

uses

from SslMM

Malware

uses

from Sykipot

Malware

uses

from TajMahal

Malware

uses

from ThiefQuest

Malware

uses

from Threat Group-3390

Group

uses

from TinyZBot

Malware

uses

from TONESHELL

Malware

uses

from Tonto Team

Group

uses

from Trojan.Karagany

Malware

uses

from Unknown Logger

Malware

uses

from VERMIN

Malware

uses

from Volt Typhoon

Group

uses

from WarzoneRAT

Malware

uses

from XAgentOSX

Malware

uses

from XLoader

Malware

uses

from yty

Malware

uses

from Zeus Panda

Malware

uses

from ZxShell

Malware

4 external

References

mitre-attack

T1056.001

open

Talos Kimsuky Nov 2021

https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html

open

Cisco Blog Legacy Device Attacks

https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954

open

Adventures of a Keystroke

http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf

open