T1056.001Credential AccessCollection
Keylogging
Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the…
CVEs1
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
3 Sigma rules tagged T1056.001KeyloggingT1056.0013 general rules
- Linux Keylogging with Pam.dhightest
- Potential Keylogger Activitymediumtest
- Powershell Keyloggingmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Keylogging
1 CVE, by priority. Each link shows its badge.- CVE-2025-33053Microsoft Windows External Control of File Name or Path VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 8.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter+3 moreMITRE CTID mapping of the KEV entry · follow-on activity87.0%Top 0.25%69.1priority