Keystrokes Input Capture from Unsigned DLL

[rule]
description = """
Identifies attempts to enumerate the state of keyboard keys and the call is coming from an unsigned DLL. Adversaries may
log user keystrokes to intercept credentials or other information from the user as the user types them.
"""
id = "8ab0b921-38fb-495c-b5b8-075d1cbc731c"
license = "Elastic License v2"
name = "Keystrokes Input Capture from Unsigned DLL"
os_list = ["windows"]
reference = [
    "https://attack.mitre.org/techniques/T1056/001/",
    "https://www.elastic.co/security-labs/protecting-your-devices-from-information-theft-keylogger-protection",
]
version = "1.0.15"

query = '''
sequence by process.entity_id with maxspan=2m
 [library where
  dll.Ext.relative_file_creation_time <= 300 and not startswith~(dll.name, process.name) and
  dll.hash.sha256 : "??*" and dll.path : "?*" and not dll.code_signature.status : "trusted" and 
  not dll.hash.sha256 : 
                ("fc23a64cc52f5b19e310a8d96b1fbfec981310359bda907f5931a53360485fbc", 
                 "47c2871dff8948de40424df497962ea6167c56bd4d487dd2e660aa2837485e25",
                 "0a70f6e2ae3e77fa9406a38b244cd49cd46356af6a6880c913be9df98c4d5136",
                 "13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03",
                 "35fce2a0bb291f9c2a7dc7b4620892cae16c71422a1ee3083c5d8c20720c8df6",
                 "dbf484369fccb68c1c573c978b67cc16d86bb7e8d13308fc8e9e0cfb0ef6724f",
                 "a8d9181b8bad99f52a81390a035694ab6541f44c7dd9d5ad10ba97fb5b209074",
                 "332c71776659988159f98e0e6621b1e37694a7a57f954e0c5ca2f95c939b8f59",
                 "14483624af18b2661c8a11df1d9333049cf582b3a31782491895fc138966ef2a",
                 "a4e18d5896c5889635efe31c6f1a0ce8ccafeabe9521e0f92c46a5861e8c290b",
                 "e7a95093be08f73aea2333cb6387eb7127a2639ab358d2e0c587d776972f2523",
                 "d988f77608000008cc7b81cbc5e5a632a3b7dfbde5e768e0f76f4cc0c802fc7e",
                 "13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03",
                 "b461a01e0855014610cc1d7047a5f7939d13b803bc835c37f0be9704698af570",
                 "8232e3b928e41feacd643dc45d2ffc702ac40640910e9a232fc5df8ed90d6c97",
                 "46f43ba8a2cb1198ba84341448812a37a3b545f2dd70e5f127d7bfc7807c2ced",
                 "a9b70a8c2b495badc2cccf96408c8838d7fedd1013590b11166323629ec36b16",
                 "c47c572f7b74d7073b6ab008a730d26ec885c67d1dcdb187839ed52cb8856287",
                 "5a730d11d2d5a38b33360e6e524f53eaf93225f196016a4f1d313e7eab16b655",
                 "b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18",
                 "b2c93337e49bdba121f679bcfa91eb3d3ddfe1776417dd80da4c6500205130d3",
                 "a037787360c924e15415b44ac64d06dfdf8265dd136d87d2354e44dd3b151894",
                 "d72f31bf226cd2de3fef3948e22c16c118fa1cc013c5358f4ea597fd0d93642d") and
  not process.executable : "C:\\Program Files\\Autodesk\\Revit 202?\\Revit.exe" and
  not dll.path : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
  not (process.code_signature.subject_name in ("Ferox Games B.V.", "Prometric, LLC", "NCS Pearson, Inc.") and process.code_signature.trusted == true)] as event0
 [api where

  (process.Ext.api.name == "GetAsyncKeyState" or
   (process.Ext.api.name == "RegisterRawInputDevices" and
    process.Ext.api.parameters.usage == "KEYBOARD" and process.Ext.api.parameters.flags like "*INPUTSINK*") or
   (process.Ext.api.name == "SetWindowsHookEx" and process.Ext.api.parameters.hook_type == "WH_KEYBOARD_LL")) and

   startswith~(process.thread.Ext.call_stack_final_user_module.name, event0.dll.name)]
'''

min_endpoint_version = "8.10.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1056"
name = "Input Capture"
reference = "https://attack.mitre.org/techniques/T1056/"
[[threat.technique.subtechnique]]
id = "T1056.001"
name = "Keylogging"
reference = "https://attack.mitre.org/techniques/T1056/001/"



[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[internal]
min_endpoint_version = "8.10.0"