Detect Keylogging in CrowdStrike LogScale
Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is commonly used when OS credential dumping techniques are ineffective, and may require monitoring a system for a substantial period before credentials are captured. Techniques include API hooking (SetWindowsHookEx, GetAsyncKeyState), reading hardware buffers, registry modifications, and custom drivers. This detection focuses on behavioral indicators of keylogger installation and activity on Windows systems.
MITRE ATT&CK
- Tactic
- Collection Credential Access
- Technique
- T1056 Input Capture
- Sub-technique
- T1056.001 Keylogging
- Canonical reference
- https://attack.mitre.org/techniques/T1056/001/
LogScale Detection Query
#event_simpleName IN ("ImageLoad", "ProcessRollup2", "SyntheticProcessRollup2", "PeFileWritten", "RegKeyCreate", "RegValueUpdate", "RegKeyUpdate")
| eval signal_type = ""
/* Signal 1: Suspicious user32.dll image load by non-standard process */
| case {
#event_simpleName = "ImageLoad"
AND ImageFileName = /(?i)\\user32\.dll$/
AND NOT ContextImageFileName = /(?i)\\(explorer|chrome|firefox|msedge|outlook|winword|excel|powerpnt|notepad|Code|teams|slack|svchost|dwm|taskhostw|ctfmon|RuntimeBroker|conhost|WerFault)\.exe$/
| signal_type := "SUSPICIOUS_USER32_HOOK_LOAD" ;
*
}
/* Signal 2: Process creation with keylogger API patterns in command line or image */
| case {
#event_simpleName IN ("ProcessRollup2", "SyntheticProcessRollup2")
AND (
CommandLine = /(?i)(SetWindowsHookEx[AW]?|GetAsyncKeyState|GetKeyState|GetKeyboardState|RegisterHotKey|CallNextHookEx|WH_KEYBOARD(_LL)?)/
OR ImageFileName = /(?i)(keylog|keystroke|\bklog\b|keycap|keyrecord|keyspy|kbdlog|keyboard_log|input_capture)/
)
| signal_type := "KEYLOGGER_API_OR_FILENAME" ;
*
}
/* Signal 3: Registry modification with keylogger driver or service patterns */
| case {
#event_simpleName IN ("RegKeyCreate", "RegValueUpdate", "RegKeyUpdate")
AND (
RegObjectName = /(?i)(keylog|kbdfilter|keyboard[._]filter|keylogdrv|kbdhook)/
OR (
RegObjectName = /(?i)CurrentControlSet\\Services/
AND RegStringValue = /(?i)(keylog|kbdfilter|keylogdrv|\bklog\b)/
)
)
| signal_type := "KEYLOGGER_REGISTRY_MODIFICATION" ;
*
}
/* Signal 4: PE file written to disk with keylogger-related name */
| case {
#event_simpleName = "PeFileWritten"
AND TargetFileName = /(?i)(keylog|keystroke|\bklog\b|keycap|keyrecord|keyspy|keyboard_log|input_capture)/
| signal_type := "KEYLOGGER_PE_FILE_CREATED" ;
*
}
| signal_type != ""
| select([@timestamp, #event_simpleName, signal_type, ComputerName, UserName, CommandLine, ImageFileName, ContextImageFileName, RegObjectName, RegStringValue, TargetFileName, TargetDirectoryName, ProcessId, ParentProcessId])
| sort(field=@timestamp, order=desc)CrowdStrike Falcon LogScale (CQL) detection for keylogger installation and activity behavioral indicators on Windows endpoints. Correlates four Falcon telemetry signals: ImageLoad events for user32.dll by non-standard processes (keyboard hook precursor), ProcessRollup2/SyntheticProcessRollup2 events containing keylogger API strings or naming patterns in command lines, registry operation events (RegKeyCreate/RegValueUpdate/RegKeyUpdate) matching keylogger driver/service patterns, and PeFileWritten events creating keylogger-named PE files. Uses CQL case expressions to label each signal type. Covers MITRE ATT&CK T1056.001.
Data Sources
Required Tables
False Positives & Tuning
- Third-party endpoint security products from competing vendors (Symantec, McAfee/Trellix, Trend Micro) load user32.dll from non-standard service paths and may install keyboard filter components — Falcon may not recognize these as trusted processes, generating false positives especially in environments running multiple security agents.
- Enterprise application monitoring and APM agents (AppDynamics, Dynatrace, New Relic) that instrument .NET or Java applications may hook keyboard APIs to measure user interaction latency, producing API-pattern detections during normal performance monitoring.
- Biometric authentication software and smart card middleware that maps keyboard events to authentication triggers can match keylogger API patterns while performing authorized multi-factor authentication operations.
Other platforms for T1056.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1SetWindowsHookEx Keyboard Hook via PowerShell
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with the inline C# code in CommandLine. Sysmon Event ID 7: Image Load for user32.dll initiated by powershell.exe. Sysmon Event ID 11: File Create for keylog_test.txt in %TEMP%. Security Event ID 4688 (if enabled) for powershell.exe process creation.
- Test 2GetAsyncKeyState Polling Loop
Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with GetAsyncKeyState in CommandLine. Sysmon Event ID 7: Image Load for user32.dll by powershell.exe. Sysmon Event ID 11: File Create for keystate_test.txt in %TEMP%.
- Test 3Keylogger Filename and Registry Persistence Simulation
Expected signal: Sysmon Event ID 11: File Create for keylogger.exe and klog_output.txt in %APPDATA%. Sysmon Event ID 13: Registry value set for HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KeyCapture. Security Event ID 4688 for powershell.exe.
- Test 4Empire-style Python Keylogger on Linux
Expected signal: Linux auditd: SYSCALL records for open('/dev/input/event0') if auditd rules are configured for /dev/input monitoring. Syslog: Process creation of python3 with suspicious inline code. File creation of /tmp/key_capture_test.log. If using Sysmon for Linux: ProcessCreate event for python3 with CommandLine containing 'dev/input' and 'struct.unpack'.
References (11)
- https://attack.mitre.org/techniques/T1056/001/
- http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf
- https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html
- https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
- https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/
- https://www.cybereason.com/blog/research/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1056.001/T1056.001.md
- https://learn.microsoft.com/en-us/windows/win32/winmsg/about-hooks
- https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowshookexw
- https://www.eset.com/int/about/newsroom/research/evasive-panda-apt-group-uses-supply-chain-attacks-to-target-tibetans/
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
Unlock Pro Content
Get the full detection package for T1056.001 including response playbook, investigation guide, and atomic red team tests.