CAPEC-568: Capture Credentials via Keylogger
An adversary deploys a keylogger in an effort to obtain credentials directly from a system's user. After capturing all the keystrokes made by a user, the adversary can analyze the data and determine which string are likely to be passwords or other credential related information.
Last updated
Overview
CAPEC-568 (Capture Credentials via Keylogger) is a detailed-level attack pattern catalogued by MITRE in the Common Attack Pattern Enumeration and Classification (CAPEC). It describes a recurring method attackers use to exploit software weaknesses.
How the attack works
The phases an attacker typically follows to carry out this attack.
- Step 1Explore
[Determine which user's credentials to capture] Since this is a more targeted attack, an adversary will first identify a particular user they wish the capture the credentials of.
- Step 2Experiment
[Deploy keylogger] Once a user is identified, an adversary will deploy a keylogger to the user's system in one of many ways.
- Send a phishing email with a malicious attachment that installs a keylogger on a user's system
- Conceal a keylogger behind fake software and get the user to download the software
- Get a user to click on a malicious URL that directs them to a webpage that will install a keylogger without their knowledge
- Gain access to the user's system through a vulnerability and manually install a keylogger
- Step 3Experiment
[Record keystrokes] Once the keylogger is deployed on the user's system, the adversary will record keystrokes over a period of time.
- Step 4Experiment
[Analyze data and determine credentials] Using the captured keystrokes, the adversary will be able to determine the credentials of the user.
- Search for repeated sequences that are following by the enter key
- Search for repeated sequences that are not found in a dictionary
- Search for several backspaces in a row. This could indicate a mistyped password. The correct password can then be inferred using the whole key sequence
- Step 5Exploit
[Use found credentials] After the adversary has found the credentials for the target user, they will then use them to gain access to a system in order to perform some follow-up attack
What the attacker needs
Prerequisites
- The ability to install the keylogger, either in person or remote.
How to mitigate it
Defenses that reduce the risk of CAPEC-568.
- Strong physical security can help reduce the ability of an adversary to install a keylogger.
Terminology & mappings
Mapped taxonomies
- ATTACK: Input Capture:Keylogging (1056.001)
Frequently asked questions
Common questions about CAPEC-568.
- What is CAPEC-568?
- An adversary deploys a keylogger in an effort to obtain credentials directly from a system's user. After capturing all the keystrokes made by a user, the adversary can analyze the data and determine which string are likely to be passwords or other credential related information.
- How does a Capture Credentials via Keylogger attack work?
- It typically unfolds over 5 phases. It begins with: [Determine which user's credentials to capture] Since this is a more targeted attack, an adversary will first identify a particular user they wish the capture the credentials of.
- How do you prevent CAPEC-568?
- Strong physical security can help reduce the ability of an adversary to install a keylogger.
- How severe is CAPEC-568?
- MITRE rates CAPEC-568 as High severity.
References
Attack-pattern data is sourced from the MITRE CAPEC catalog (v3.9). Weakness associations link to the corresponding CWE entries on RadicalNotion.AI.
Defend against CAPEC-568
Track the CVEs and weaknesses attackers exploit with this technique, with AI-written analysis and remediation guidance.