Elastic Defend high stable eql

Keystrokes Input Capture from Unsigned DLL

Identifies attempts to enumerate the state of keyboard keys and the call is coming from an unsigned DLL. Adversaries may log user keystrokes to intercept credentials or other information from the user as the user types them.

View Source

Detection Logic

sequence by process.entity_id with maxspan=2m
 [library where
  dll.Ext.relative_file_creation_time <= 300 and not startswith~(dll.name, process.name) and
  dll.hash.sha256 : "??*" and dll.path : "?*" and not dll.code_signature.status : "trusted" and 
  not dll.hash.sha256 : 
                ("fc23a64cc52f5b19e310a8d96b1fbfec981310359bda907f5931a53360485fbc", 
                 "47c2871dff8948de40424df497962ea6167c56bd4d487dd2e660aa2837485e25",
                 "0a70f6e2ae3e77fa9406a38b244cd49cd46356af6a6880c913be9df98c4d5136",
                 "13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03",
                 "35fce2a0bb291f9c2a7dc7b4620892cae16c71422a1ee3083c5d8c20720c8df6",
                 "dbf484369fccb68c1c573c978b67cc16d86bb7e8d13308fc8e9e0cfb0ef6724f",
                 "a8d9181b8bad99f52a81390a035694ab6541f44c7dd9d5ad10ba97fb5b209074",
                 "332c71776659988159f98e0e6621b1e37694a7a57f954e0c5ca2f95c939b8f59",
                 "14483624af18b2661c8a11df1d9333049cf582b3a31782491895fc138966ef2a",
                 "a4e18d5896c5889635efe31c6f1a0ce8ccafeabe9521e0f92c46a5861e8c290b",
                 "e7a95093be08f73aea2333cb6387eb7127a2639ab358d2e0c587d776972f2523",
                 "d988f77608000008cc7b81cbc5e5a632a3b7dfbde5e768e0f76f4cc0c802fc7e",
                 "13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03",
                 "b461a01e0855014610cc1d7047a5f7939d13b803bc835c37f0be9704698af570",
                 "8232e3b928e41feacd643dc45d2ffc702ac40640910e9a232fc5df8ed90d6c97",
                 "46f43ba8a2cb1198ba84341448812a37a3b545f2dd70e5f127d7bfc7807c2ced",
                 "a9b70a8c2b495badc2cccf96408c8838d7fedd1013590b11166323629ec36b16",
                 "c47c572f7b74d7073b6ab008a730d26ec885c67d1dcdb187839ed52cb8856287",
                 "5a730d11d2d5a38b33360e6e524f53eaf93225f196016a4f1d313e7eab16b655",
                 "b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18",
                 "b2c93337e49bdba121f679bcfa91eb3d3ddfe1776417dd80da4c6500205130d3",
                 "a037787360c924e15415b44ac64d06dfdf8265dd136d87d2354e44dd3b151894",
                 "d72f31bf226cd2de3fef3948e22c16c118fa1cc013c5358f4ea597fd0d93642d") and
  not process.executable : "C:\\Program Files\\Autodesk\\Revit 202?\\Revit.exe" and
  not dll.path : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
  not (process.code_signature.subject_name in ("Ferox Games B.V.", "Prometric, LLC", "NCS Pearson, Inc.") and process.code_signature.trusted == true)] as event0
 [api where

  (process.Ext.api.name == "GetAsyncKeyState" or
   (process.Ext.api.name == "RegisterRawInputDevices" and
    process.Ext.api.parameters.usage == "KEYBOARD" and process.Ext.api.parameters.flags like "*INPUTSINK*") or
   (process.Ext.api.name == "SetWindowsHookEx" and process.Ext.api.parameters.hook_type == "WH_KEYBOARD_LL")) and

   startswith~(process.thread.Ext.call_stack_final_user_module.name, event0.dll.name)]

Field Validations

Loading…

Comments (0)

Loading comments...