Hardware keylogger
Physical device between keyboard and computer records keystrokes
categoryPhysical, insider and cross-cutting attacksseverityHighdetectabilityMediumlabnot yet measured
Example: tampered payment terminals
Classification
33 values: 18 imported, 3 derived, 12 machine-classified. What do these mean?
Exploitability
| Attack vector | Credential attacksMalwarePhysical |
|---|---|
| Reach (CVSS) | Physical |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Attacker skill required | Low |
| Resources required | Low |
| Likelihood / prevalence | Low |
| Maturity | Established |
Impact & scope
| Severity | High |
|---|---|
| Impact | Confidentiality |
| Platform | LinuxmacOSNetwork DevicesWindows |
| Environment | On-premises |
| Target asset class | EndpointPhysical |
| Kill-chain phase (tactic) | CollectionCredential Access |
Detection & telemetry
| Detectability | Medium |
|---|---|
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | File AccessFirmware ModificationNetwork Traffic ContentOS API ExecutionProcess AccessProcess CreationService CreationWindows Registry Key Modification |
Detection & response
Mitigated by 4
D3-HCId3fendD3-IDAd3fendD3-IOPRd3fendD3-RHd3fend
Detected by 4
- DET0089 attack-detection-strategy
34f90d3c-c297-49e9-b26d-911b05a4866csigma49aae26c-450e-448b-911d-b3c13d178dfcsigma965e2db9-eddb-4cf6-a986-7a967df651e4sigma
Tested by 8
0e59d59d-3265-4d35-bebd-bf5c1ec40db5atomic7f85a946-a0ea-48aa-b6ac-8ff539278258atomic81d7d2ad-d644-4b6a-bea7-28ffe43beccaatomic9c6bdb34-a89f-4b90-acb1-5970614c711batomica668edb9-334e-48eb-8c2e-5413a40867afatomicaee3a097-4c5c-4fff-bbd3-0a705867ae29atomicb04284dc-3bd9-4840-8d21-61b8d31c99f2atomicd9b633ca-8efb-45e6-b838-70f595c6ae26atomic
Attack relationships
- Parent: Spyware
Framework references
- Primary source: https://en.wikipedia.org/wiki/Hardware_keylogger
- attack: T1056.001 (primary)
- capec: CAPEC-568
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Physical, insider and cross-cutting attacks' table, line 679 of Cyber-Attack-Taxonomy.md
- ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1056.001, capec:CAPEC-568 as the nearest framework entries; ids verified to exist in the cached catalogues.
- ev-0003 (CAPEC — Common Attack Pattern Enumeration and Classification 3.9) — CAPEC-568 Capture Credentials via Keylogger: CAPEC prerequisites for this pattern
The ability to install the keylogger, either in person or remote.
- ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 155 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)