Keystroke Messages Hooking via SetWindowsHookEx

api where process.Ext.api.name == "SetWindowsHookEx" and process.Ext.api.parameters.hook_type == "WH_KEYBOARD_LL" and
 process.Ext.api.parameters.hook_module == "null" and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and not process.code_signature.status : "trusted" and
 process.thread.Ext.call_stack_summary : "?*" and process.executable != null and
 not process.thread.Ext.call_stack_summary :
                               ("*user32.dll
| explorer.exe
| user32.dll*",
                                "*user32.dll
| tabskb.dll
| kernel32.dll*",
                                "*user32.dll
| taskbar.dll*",
                                "win32u.dll
| user32.dll
| pilotshubapp.dll",
                                "*win32u.dll
| user32.dll
| mtb.exe
| mfc90u.dll
| mtb.exe*",
                                "win32u.dll
| user32.dll
| powertoy*",
                                "win32u.dll
| user32.dll
| rdclientax.dl*",
                                "*qt6gui.dll
| qt6core.dll*",
                                "win32u.dll
| user32.dll
| rwsfoundation_x64.dll
| ucrtbase.dll
| kernel32.dll
| ntdll.dll",
                                "win32u.dll
| user32.dll
| autohotkey*.exe
| kernel32.dll
| ntdll.dll") and
 not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                        ("1683394a15b58815a01bbe030dfc1e441a9b0f7f38d18bd5c13d41d573d58f53",
                         "bec3b34c8e9c04a1da28c623fb06cee45739113a38a1eae52d2a3b208c4baa6f",
                         "0d083e72eb0e8cbcec2c347840bff815513eecf29648065163b08c600f6c95ff",
                         "38011e713b4be8577576062754cad03e9899859488932ae4c9c83e5fbb5cb7d2",
                         "b67e006287fba2278f897d242ff58548b7d6b15ac490a91c26318c6f396da195",
                         "feaf9479260db6f41d1e6443d0d80826eeee4905ef97a1cab78c16bc304248a5",
                         "465d3985e1dd8bc69137e2a8c5a4a6ba16b0ff99c647245ca66942750ccc75ef",
                         "549888a9e268dd5ca6544cabc8266148ff0d8728c3aa0f1c68f9f8bcb116e53d") and
 not process.thread.Ext.call_stack_final_user_module.path :
                        ("?:\\Program Files\\*",
                         "?:\\Program Files (x86)\\*",
                         "?:\\windows\\system32\\*",
                         "?:\\windows\\syswow64\\*",
                         "\\Program Files\\*",
                         "\\Program Files (x86)\\*",
                         "\\windows\\system32\\*",
                         "\\windows\\syswow64\\*",
                         "?:\\windows\\explorer.exe",
                         "\\windows\\explorer.exe",
                         "*\\windows\\systemapps\\*",
                         "c:\\windows\\microsoft.net\\framework*\\clr.dll",
                         "*\\windows\\assembly\\*",
                         "?:\\windows\\systemapps\\*.dll",
                         "?:\\Windows\\WinSxS\\*.dll",
                         "?:\\windows\\assembly\\*.dll",
                         "\\windows\\systemapps\\*.dll",
                         "\\Windows\\WinSxS\\*.dll",
                         "\\windows\\assembly\\*.dll",
                         "\\windows\\shellexperiences\\*.dll",
                         "?:\\progra~?\\citrix\\icacli~?\\vdkbhook.dll",
                         "?:\\windows\\shellexperiences\\*.dll",
                         "\\windows\\shellexperiences\\*.dll",
                         "?:\\windows\\jmesoft\\keyhook.dll",
                         "?:\\users\\*\\appdata\\local\\microsoft\\teams\\current\\d3dcompiler_??.dll",
                         "\\device\\mup\\*",
                         "?:\\windows\\immersivecontrolpanel\\systemsettings.dll") and
    not process.thread.Ext.call_stack_final_user_module.name : ("Unknown", "Undetermined") and
    not process.thread.Ext.call_stack_final_user_module.protection_provenance : ("hmpalert.dll", "kernel") and
    not process.executable :
                ("?:\\Program Files\\workspacer\\workspacer.exe",
                 "?:\\Program Files (x86)\\Do It Again\\DoItAgain.exe",
                 "?:\\Program Files (x86)\\HP\\HP LaserJet Pro MFP *\\bin\\HPScan.exe",
                 "?:\\Program Files (x86)\\Avaya\\Avaya IX Workplace\\fTarget\\Avaya.BrowserExtension.exe") and
    not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.status : "trusted")