attack.t1056.002

CredUI.DLL Loaded By Uncommon Process

Aug 12, 2024 · attack.credential-access attack.collection attack.t1056.002 ·

Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".

GUI Input Capture - macOS

Aug 12, 2024 · attack.credential-access attack.t1056.002 ·

Share on:

Detects attempts to use system dialog prompts to capture user credentials

PUA - Mouse Lock Execution

Aug 12, 2024 · attack.credential-access attack.collection attack.t1056.002 ·

Share on:

In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.