Web Portal Capture

MITRE ATT&CK T1056.003 describes installing code on externally facing portals, such as a VPN login page, to capture and transmit submitted credentials, potentially before normal service authentication completes. ATT&CK maps the technique to Collection and Credential Access and to Linux, Windows, and macOS. The exercise below is limited to benign file-integrity monitoring on an explicitly authorized staging copy; it does not install capture code, submit credentials, or demonstrate credential collection.