| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name |
|---|---|---|---|---|
| action.malware.variety.Spyware/Keylogger | Spyware, keylogger or form-grabber (capture user input or activity) | related-to | T1056.004 | Input Capture: Credential API Hooking |
| action.malware.variety.Spyware/Keylogger | Spyware, keylogger or form-grabber (capture user input or activity) | related-to | T1111 | Two-Factor Authentication Interception |