Keylogger

Records keystrokes via API hooks or drivers

categoryMalwareseverityHighdetectabilityMediumlabnot yet measured

Example: Agent Tesla

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1056.001 · Bash session based keylogger · Atomic Red Team

sudo /opt/lab/detonate.sh --technique T1056.001 --tool atomic --run-id <run-id> -- pwsh -c 'Import-Module invoke-atomicredteam; Invoke-AtomicTest T1056.001 -TestGuids 7f85a946-a0ea-48aa-b6ac-8ff539278258 -GetPrereqs -PathToAtomicsFolder /opt/AtomicRedTeam/atomics; Invoke-AtomicTest T1056.001 -TestGuids 7f85a946-a0ea-48aa-b6ac-8ff539278258 -PathToAtomicsFolder /opt/AtomicRedTeam/atomics -TimeoutSeconds 120'

Queued for lab measurement — not yet detonated.

Classification

33 values: 13 reviewed, 17 imported, 3 derived. What do these mean?

Exploitability

Attack vector	Credential attacksMalware
Reach (CVSS)	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	Confidentiality
Platform	LinuxmacOSNetwork DevicesWindows
Environment	MobileOn-premises
Target asset class	EndpointIdentity
Kill-chain phase (tactic)	CollectionCredential Access

Detection & telemetry

Detectability	Medium
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	File AccessFirmware ModificationNetwork Traffic ContentOS API ExecutionProcess AccessProcess CreationProcess MetadataService CreationWindows Registry Key Modification

Detection & response

Mitigated by 4

D3-HCI d3fend
D3-IDA d3fend
D3-IOPR d3fend
D3-RH d3fend

Detected by 4

DET0089 attack-detection-strategy
34f90d3c-c297-49e9-b26d-911b05a4866c sigma
49aae26c-450e-448b-911d-b3c13d178dfc sigma
965e2db9-eddb-4cf6-a986-7a967df651e4 sigma

Tested by 8

0e59d59d-3265-4d35-bebd-bf5c1ec40db5 atomic
7f85a946-a0ea-48aa-b6ac-8ff539278258 atomic
81d7d2ad-d644-4b6a-bea7-28ffe43becca atomic
9c6bdb34-a89f-4b90-acb1-5970614c711b atomic
a668edb9-334e-48eb-8c2e-5413a40867af atomic
aee3a097-4c5c-4fff-bbd3-0a705867ae29 atomic
b04284dc-3bd9-4840-8d21-61b8d31c99f2 atomic
d9b633ca-8efb-45e6-b838-70f595c6ae26 atomic

Attack relationships

Parent: Spyware

Framework references

Primary source: https://attack.mitre.org/techniques/T1056/001/
attack: T1056.001 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 85 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 155 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)