Input Capture: Keylogging

Threat Actors may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require Threat Actors to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, Threat Actors may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.