CAPEC-568 詳細

実行フロー

[Determine which user's credentials to capture] Since this is a more targeted attack, an adversary will first identify a particular user they wish the capture the credentials of.

[Deploy keylogger] Once a user is identified, an adversary will deploy a keylogger to the user's system in one of many ways.

• Send a phishing email with a malicious attachment that installs a keylogger on a user's system
• Conceal a keylogger behind fake software and get the user to download the software
• Get a user to click on a malicious URL that directs them to a webpage that will install a keylogger without their knowledge
• Gain access to the user's system through a vulnerability and manually install a keylogger

[Record keystrokes] Once the keylogger is deployed on the user's system, the adversary will record keystrokes over a period of time.

[Analyze data and determine credentials] Using the captured keystrokes, the adversary will be able to determine the credentials of the user.

• Search for repeated sequences that are following by the enter key
• Search for repeated sequences that are not found in a dictionary
• Search for several backspaces in a row. This could indicate a mistyped password. The correct password can then be inferred using the whole key sequence

[Use found credentials] After the adversary has found the credentials for the target user, they will then use them to gain access to a system in order to perform some follow-up attack

前提条件

緩和策

登録情報

変更履歴