Skip to content

DET0705 Detection of Input Capture

Item Value
ID DET0705
Version 1.0
Created 21 October 2025
Last Modified 21 October 2025

Technique Detected: T1417 (Input Capture)

Analytics

Android

AN1825

The user can view and manage installed third-party keyboards. Application vetting services can look for applications requesting the permissions granting access to accessibility services or application overlay.

Log Sources
Data Component Name Channel
System Settings (DC0118) User Interface None
Permissions Requests (DC0114) Application Vetting None
Mutable Elements
Field Description

iOS

AN1826

The user can view and manage installed third-party keyboards. Application vetting services can look for applications requesting the permissions granting access to accessibility services or application overlay.

Log Sources
Data Component Name Channel
System Settings (DC0118) User Interface None
Permissions Requests (DC0114) Application Vetting None
Mutable Elements
Field Description