{"id":"T1111","name":"Multi-Factor Authentication Interception","url":"https://attack.mitre.org/techniques/T1111","tactics":["credential-access"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0246","stix_id":"x-mitre-detection-strategy--6df13a5a-7d2b-4c9d-8c6e-d57ca850fe15","name":"Detection Strategy for MFA Interception via Input Capture and Smart Card Proxying","url":"https://attack.mitre.org/detectionstrategies/DET0246","analytics":[{"id":"AN0687","stix_id":"x-mitre-analytic--8180320e-ab62-44e5-afae-eba6ba23d769","name":"Analytic 0687","description":"Behavior chain involving unexpected API calls to capture keyboard input, driver loads for keyloggers, or remote use of smart card authentication via logon sessions not initiated by local user interaction","url":"https://attack.mitre.org/detectionstrategies/DET0246#AN0687","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4624, 4648","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"AccessMask","description":"Tunable based on what memory-level access the keylogger uses (e.g., 0x10 for read)"},{"field":"ProcessNameExclusions","description":"Legitimate accessibility tools may use similar API calls (e.g., Magnifier.exe)"},{"field":"TimeWindow","description":"Define how quickly access + registry mod + smart card use must co-occur"}],"live":true,"detection_strategies":["DET0246"],"techniques":["T1111"]},{"id":"AN0688","stix_id":"x-mitre-analytic--1a13d795-7c26-44b6-ad1b-2ad732dc33c3","name":"Analytic 0688","description":"Detection of unauthorized keylogger behavior through access to `/dev/input`, loading kernel modules (e.g., via insmod), or polling user input devices from non-user shells","url":"https://attack.mitre.org/detectionstrategies/DET0246#AN0688","platforms":["Linux"],"log_source_references":[{"name":"linux:syslog","channel":"syscalls (open, read, ioctl) on /dev/input or /proc/*/fd/*","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"linux-syslog"},{"name":"linux:syslog","channel":"dmesg or syslog for module loads","data_component":"DC0079","data_component_name":"Driver Load","log_source_slug":"linux-syslog"}],"mutable_elements":[{"field":"PathTarget","description":"Can tune based on device paths accessed for keyboard input (e.g., /dev/input/event0)"},{"field":"UserContext","description":"Exclude root or admin-auth shell sessions if needed"},{"field":"ModuleWhitelist","description":"Set a known list of allowed kernel modules"}],"live":true,"detection_strategies":["DET0246"],"techniques":["T1111"]},{"id":"AN0689","stix_id":"x-mitre-analytic--7d5eb9bd-5e53-4cf8-b86d-7136bbf8f673","name":"Analytic 0689","description":"Processes accessing TCC-protected input APIs or polling HID services without user interaction, or dynamically loaded keylogging frameworks using accessibility privileges","url":"https://attack.mitre.org/detectionstrategies/DET0246#AN0689","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"com.apple.securityd, com.apple.tccd","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"query: process_events, launchd, and tcc.db access","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"AccessibilityAPIUsage","description":"Detection of programs requesting access to input monitoring (e.g., CGEventTap)"},{"field":"TCCBypassAttempt","description":"Alert if TCC settings are altered or bypassed"},{"field":"SignedBinaryCheck","description":"Tunable based on developer signing status (legitimate software vs unsigned)"}],"live":true,"detection_strategies":["DET0246"],"techniques":["T1111"]}],"live":true,"version":"1.0","techniques":["T1111"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}