| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name |
|---|---|---|---|---|
| action.malware.variety.Spyware/Keylogger | Spyware, keylogger or form-grabber (capture user input or activity) | related-to | T1111 | Multi-Factor Authentication Interception |
| action.malware.variety.Spyware/Keylogger | Spyware, keylogger or form-grabber (capture user input or activity) | related-to | T1546.017 | Udev Rules |