Input Capture
Technique · ATTACK:enterprise:T1056
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1056",
"title": "Input Capture",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1056",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--bb5a00de-e086-4859-a231-fa793f6797e2",
"external_id": "T1056",
"domain": "enterprise",
"created": "2017-05-31T21:30:48.323Z",
"modified": "2025-10-24T17:49:17.884Z",
"version": "1.4",
"aliases": [
],
"tactics": [
"collection",
"credential-access"
],
"source_references": [
{
"source_name": "Adventures of a Keystroke",
"url": "http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf"
}
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1245 → uses → ATTACK:enterprise:T1056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--244a8358-96fb-41ce-9cc3-c4899a6f4de4
PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37f4170b-b4ea-470b-8ee6-ff15ba35d472
Mandiant APT42-untanglingATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58c773e3-a31b-4562-83a5-815cf958b6be
rapid7-email-bombingATTACK:enterprise:T1056.001 → subtechnique-of → ATTACK:enterprise:T1056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5eac9edf-ec42-4ad9-846e-e36b533fd257
ATTACK:enterprise:S1059 → uses → ATTACK:enterprise:T1056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69d4f4f9-adb0-41fc-952d-88579ab5b46b
SentinelLabs Metador Technical Appendix Sept 2022ATTACK:enterprise:T1056.002 → subtechnique-of → ATTACK:enterprise:T1056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6db133fd-2beb-4c5e-a97c-3d3ef03bee50
ATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6eb97f82-c49f-465d-b788-15a789f928b5
SentinelLabs Metador Technical Appendix Sept 2022ATTACK:enterprise:C0039 → uses → ATTACK:enterprise:T1056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a3a64ecb-572b-4dc3-b95f-8b46be7b857a
Lumen Versa 2024ATTACK:enterprise:T1056.004 → subtechnique-of → ATTACK:enterprise:T1056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6270b8b-89b1-484f-9da9-a1111c74ad11
ATTACK:enterprise:S0631 → uses → ATTACK:enterprise:T1056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a74d38f5-92dc-4944-b840-0ab567f8f3ab
Cybereason Chaes Nov 2020ATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a923dc9f-1a0c-4f1c-ad52-4c07011afcf1
CISA Leviathan 2024ATTACK:enterprise:S0381 → uses → ATTACK:enterprise:T1056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae3897f5-099d-46b0-b645-81a9a45445fa
Korean FSI TA505 2020ATTACK:enterprise:T1056.003 → subtechnique-of → ATTACK:enterprise:T1056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c075f36d-2732-4258-b921-3f07845bc367
ATTACK:enterprise:S0641 → uses → ATTACK:enterprise:T1056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf2df7c3-3efe-49d9-9c49-e35978d784c4
ESET Kobalos Feb 2021 · ESET Kobalos Jan 2021ATTACK:enterprise:S1131 → uses → ATTACK:enterprise:T1056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dd9677aa-d14a-427f-9b47-2ce722278344
Huntress NPPSPY 2022ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1056
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f11ab582-8ea8-4ed7-9b1e-2b31dce390da
FBI FLASH APT39 September 2020