T1056.002 GUI Input Capture — ATT&CK Technique

Activity timeline

T1056.002 first appeared in tracked threats on 2026-02-16 and was most recently reported on 2026-10-02. The busiest month was 2026-07 with 10 reports, and 36 of the 36 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1056.002 GUI Input Capture is catalogued by MITRE ATT&CK under the Credential Access and Collection tactics in the Enterprise matrix, as a sub-technique of T1056 Input Capture. Threadlinqs maps 36 of 2623 tracked threats (1.4%) to it; by severity that is 2 critical, 33 high, 1 medium.

Threats that use T1056.002 most often also use T1036.005 Match Legitimate Resource Name or Location (27 threats), T1027 Obfuscated Files or Information (26 threats), T1071.001 Web Protocols (26 threats), T1082 System Information Discovery (25 threats), T1005 Data from Local System (24 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

11 tracked threat actors appear in the threats that use T1056.002; the most frequent are Woodgnat (3), ClickLock Dev (2), AMOS Operators (1), APT38 (1), Andariel (1).

Mitigations

MITRE ATT&CK lists 1 mitigation for T1056.002.

M1017 User Training

Data sources

Telemetry that can reveal T1056.002, per MITRE ATT&CK.

Command — Command Execution
Process — Process Creation
Script — Script Execution

Threat actors using it

Tracked threats

The 30 most recent of 36 tracked threats that use T1056.002.

Detection coverage

Threadlinqs maintains 72 detection rules mapped to T1056.002 (SPL 24, KQL 28, Sigma 20). Rule content is available to Blue tier accounts and above; this page shows counts only.

72 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans

Parent technique

T1056 Input Capture — 285 tracked threats at the technique level.