---
{
  "title": "Input Capture",
  "summary": "Input capture observes user-entered information through software or deceptive interfaces.",
  "topic": "foundations",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    3
  ],
  "aliases": [
    "T1056"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1056: Input Capture",
      "url": "https://attack.mitre.org/techniques/T1056"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Input capture observes user-entered information through software or deceptive interfaces. Captured input may include credentials and sensitive application data.

MITRE ATT&CK catalogs this behavior as **T1056**, within collection, credential access. The technique describes a behavior; assigning the label does not by itself prove an actor identity or successful compromise.

## An investigation example

An unfamiliar background process interacts with input APIs while the user enters credentials into several applications.

## Evidence to examine

Review input hooks, process provenance, application context, output artifacts, and any subsequent credential use.

## A common analytical pitfall

Input access is also used by accessibility tools and input-method software; compare behavior and authorization.

## Response considerations

Protect potentially exposed credentials and preserve capture evidence while determining which applications and time periods were affected.

## Capture can occur before protected transmission

A fictional employee types a password into a compromised application interface. Encrypting the later network connection does not protect the value from software that already sees it at the endpoint. The location of capture matters: browser content, a deceptive dialog, and endpoint-level monitoring involve different mechanisms and evidence.

Not every input-related event is malicious. Accessibility tools and legitimate applications may interact with input under expected permissions. Investigators should examine process identity, installation history, user context, and subsequent use of collected information rather than treating one API call as conclusive.

The captured information may include more than passwords. Search terms, messages, account details, and one-time codes can be consequential. Determine the actual scope from evidence instead of assuming every keystroke was recorded. Handle any collected artifacts carefully because the investigation itself may encounter sensitive material.

## Draw the path from input to destination

For a paper exercise, show a user, an application, a local capture point, and the intended service. Mark where plaintext is visible and where transport protection begins. Explain why a secure connection does not repair a compromised input interface. Use fictional values and do not deploy monitoring software on another person's device.

Containment should address the endpoint or application responsible for capture as well as affected credentials. Replacing a password on the same compromised device can expose the new value. Depending on evidence, revoke sessions and review consequential actions taken after exposure. A useful report states the capture mechanism, time window, information scope, and confidence, keeping observed behavior separate from assumptions about complete surveillance or successful later access.

## Related concepts

- [[authentication]]
- [[least-privilege]]
- [[incident-response]]