{
  "technique_id": "T1056",
  "name": "Input Capture",
  "tactics": [
    "Collection",
    "Credential Access"
  ],
  "platforms": [
    "Linux",
    "macOS",
    "Network Devices",
    "Windows"
  ],
  "summary": "Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g...",
  "generated_by": "SOC Response Atlas by Basyrix"
}