Patchfirst
T1056.001Credential AccessCollection

Keylogging

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the…

attack.mitre.org ↗
CVEs1
In 1
Reports0

Detections

3 Sigma rules tagged T1056.001
KeyloggingT1056.0013 general rules

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Keylogging

1 CVE, by priority. Each link shows its badge.
  1. CVE-2025-33053Microsoft Windows External Control of File Name or Path Vulnerability
    Microsoft · WindowsKEVPublic exploitHigh · 8.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter+3 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    87.0%Top 0.25%
    69.1priority
↑ ↓ chooseEnter openEsc close