Elastic Defend high stable eql

Keystroke Input Capture via RegisterRawInputDevices

Identifies attempts to register for input from the keyboard using RegisterRawInputDevices API. Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them.

View Source

Detection Logic

api where
 process.Ext.api.name == "RegisterRawInputDevices" and not process.code_signature.status : "trusted" and
 process.Ext.api.parameters.usage == "KEYBOARD" and
 process.Ext.api.parameters.flags like "*INPUTSINK*" and process.thread.Ext.call_stack_summary : "?*" and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and process.executable != null and
 not process.thread.Ext.call_stack_final_user_module.path :
                         ("*\\program files*", "*\\windows\\system32\\*", "*\\windows\\syswow64\\*",
                          "*\\windows\\systemapps\\*",
                          "*\\users\\*\\appdata\\local\\*\\kumospace.exe",
                          "*\\users\\*\\appdata\\local\\microsoft\\teams\\current\\teams.exe") and 
 not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and 
 process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                       ("2e2dc7f8da5e1cc8510e0b3724dc4448a693f3fb76891cea7be5973aa9d94034",
                                        "9e039448344e4f70122a9cb2416cf282d26033ec8a81b3084c8e7076e3242d8b")

Field Validations

Loading…

Comments (0)

Loading comments...