CAPEC-568: Capture Credentials via Keylogger
Description
An adversary deploys a keylogger in an effort to obtain credentials directly from a system's user. After capturing all the keystrokes made by a user, the adversary can analyze the data and determine which string are likely to be passwords or other credential related information.
- Likelihood of attack
- Not rated by MITRE
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Collect and Analyze Information
Prerequisites
- The ability to install the keylogger, either in person or remote.
Mitigations
- Strong physical security can help reduce the ability of an adversary to install a keylogger.
Related weaknesses (CWE)
CAPEC 3.9 links no CWE weakness to this pattern.
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-IDAInput Device Analysis1 shared
- D3-IOPRIO Port Restriction1 shared
- D3-MBTMemory Boundary Tracking1 shared
- D3-PCSVProcess Code Segment Verification1 shared
- D3-SBVService Binary Verification1 shared
- D3-HCIHardware Component Inventory1 shared
- D3-RHRadiation Hardening1 shared
- D3-PSEPProcess Segment Execution Prevention1 shared
- D3-SAORSegment Address Offset Randomization1 shared
- D3-AVEAsset Vulnerability Enumeration1 shared
- D3-RSRestore Software1 shared
- D3-SWISoftware Inventory1 shared