BIOC
Informational
✕
GUI Input Capture
Prompt user to supply a password in response to a System Preference dialog pop up message.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Credential Access
- Status:
- Enabled
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Input Capture: GUI Input Capture (T1056.002)
Indicator:
Process action type = execution AND target process cmd =~ .*-e[[:blank:]]+tell app \"System Preferences\" to activate.*tell app \"System Preferences\" to display dialog.*[[:blank:]]+return.*answer.* AND target process name = osascript
Preventable: yes