T1056Credential AccessCollection
Input Capture
Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking) or rely on deceiving the user into providing input into what they…
CVEs4
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.4
Reports1
Detections
2 Sigma rules tagged T1056Input CaptureT10562 general rules
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Input Capture
4 CVEs, by priority. Each link shows its badge.- CVE-2020-8195Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure VulnerabilityCitrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceKEVPublic exploitMedium · 6.5T1056Input CaptureT1082System Information Discovery+1 moreMITRE CTID mapping of the KEV entry · how it is exploited33.0%Top 1.6%77.2priority
- CVE-2020-8196Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure VulnerabilityCitrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceKEVPublic exploitMedium · 4.3T1056Input CaptureT1082System Information Discovery+1 moreMITRE CTID mapping of the KEV entry · how it is exploited26.3%Top 2%75.6priority
- CVE-2024-42009RoundCube Webmail Cross-Site Scripting VulnerabilityRoundcube · WebmailKEVPublic exploitCritical · 9.3T1566.002Spearphishing LinkT1056Input Capture+1 moreMITRE CTID mapping of the KEV entry · primary impact82.9%Top 0.33%69.4priority
- CVE-2025-48700Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting VulnerabilitySynacor · Zimbra Collaboration Suite (ZCS)KEVMedium · 6.1T1566.002Spearphishing LinkT1059.007JavaScript+1 moreAI mapping from the description · primary impact1.7%Top 23%62.7priority
Linked through a sub-technique
1 more- CVE-2025-33053Microsoft Windows External Control of File Name or Path VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 8.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter+3 more87.0%Top 0.25%69.1priority