CmdID / Techniques / T1056

T1056.002 Input Capture: GUI Input Capture

Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. MITRE ATT&CK

2 Sigma rules T1056.002 on attack.mitre.org