{"id":"965e2db9-eddb-4cf6-a986-7a967df651e4","title":"Potential Keylogger Activity","description":"Detects PowerShell scripts that contains reference to keystroke capturing functions","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-01-04","modified":"","tags":["attack.collection","attack.credential-access","attack.t1056.001"],"technique_ids":["T1056.001"],"logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"falsepositives":["Unknown"],"references":["https://twitter.com/ScumBots/status/1610626724257046529","https://www.virustotal.com/gui/file/d4486b63512755316625230e0c9c81655093be93876e0d80732e7eeaf7d83476/content","https://www.virustotal.com/gui/file/720a7ee9f2178c70501d7e3f4bcc28a4f456e200486dbd401b25af6da3b4da62/content","https://learn.microsoft.com/en-us/dotnet/api/system.windows.input.keyboard.iskeydown?view=windowsdesktop-7.0"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_susp_keylogger_activity.yml","source_sha256":"b98325e9bdbb16a988ad137f74d765765b0e110a36ffb374a4fa0d0bbbbdfb8f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_susp_keylogger_activity.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Keylogger Activity\nid: 965e2db9-eddb-4cf6-a986-7a967df651e4\nstatus: test\ndescription: Detects PowerShell scripts that contains reference to keystroke capturing functions\nreferences:\n    - https://twitter.com/ScumBots/status/1610626724257046529\n    - https://www.virustotal.com/gui/file/d4486b63512755316625230e0c9c81655093be93876e0d80732e7eeaf7d83476/content\n    - https://www.virustotal.com/gui/file/720a7ee9f2178c70501d7e3f4bcc28a4f456e200486dbd401b25af6da3b4da62/content\n    - https://learn.microsoft.com/en-us/dotnet/api/system.windows.input.keyboard.iskeydown?view=windowsdesktop-7.0\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-01-04\ntags:\n    - attack.collection\n    - attack.credential-access\n    - attack.t1056.001\nlogsource:\n    product: windows\n    category: ps_script\n    definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n    selection:\n        ScriptBlockText|contains: '[Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1056.001","id":"T1056.001","name":"Keylogging","page":"techniques/enterprise/T1056.001/"}],"data_path":"data/detection-rules/965e2db9-eddb-4cf6-a986-7a967df651e4.json","kind":"sigma"}