Cross-source coverage

T1056.001 / ATT&CK

Input Capture: Keylogging

25 rules · 24 families across 5 sources.

From MITRE ATT&CK 19.2

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.

Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes. Some methods include:

  • Hooking API callbacks used for processing keystrokes. Unlike Credential API Hooking, this focuses solely on API functions intended for processing keystroke data.
  • Reading raw keystroke data from the hardware buffer.
  • Windows Registry modifications.
  • Custom drivers.
  • Modify System Image may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.
Platforms
Linux · macOS · Network Devices · Windows
Telemetry
WinEventLog:SysmonWinEventLog:SecurityWinEventLog:Systemauditd:SYSCALLmacos:unifiedlogmacos:osquerynetworkdevice:syslogNSM:Flow

How MITRE says to detect it DET0089

Behavioral Detection of Keylogging Activity Across Platforms

Windows Analytic 0243

Monitors suspicious usage of Windows API calls like SetWindowsHookEx, GetKeyState, or polling functions within non-UI service processes, combined with Registry or driver modifications.

  • WinEventLog:Sysmon EventCode=10
  • WinEventLog:Security EventCode=4663, 4670, 4656
  • WinEventLog:System EventCode=7045
  • WinEventLog:Sysmon EventCode=13, 14

Linux Analytic 0244

Detects non-system processes accessing /dev/input/* or issuing ptrace/evdev syscalls used for reading keystroke buffers directly.

  • auditd:SYSCALL open, read
  • auditd:SYSCALL ptrace, ioctl

macOS Analytic 0245

Detects unauthorized TCC access or use of Quartz Event Services (CGEventTapCreate) or IOHID for event tap installation within unexpected processes.

  • macos:unifiedlog subsystem=com.apple.TCC
  • macos:osquery process_events OR launchd

Network Devices Analytic 0246

Keylogging on legacy network devices via unauthorized system image modification or remote capture of console keystrokes (telnet, SSH) through altered firmware or man-in-the-middle key sniffing.

  • networkdevice:syslog Image Upgrade / Configuration Change
  • NSM:Flow packet capture or DPI logs

View on attack.mitre.org ↗

elastic/protections-artifacts

11 rules
Detection Severity Format
GetAsyncKeyState API Call from Suspicious Process Undefined Elastic TOML
Keystroke Capture by Unsigned Process Undefined Elastic TOML
Keystroke Input Capture via DirectInput Undefined Elastic TOML
Keystroke Input Capture via RegisterRawInputDevices Undefined Elastic TOML
Keystroke Messages Hooking via SetWindowsHookEx Undefined Elastic TOML
Keystrokes Input Capture from a Managed Application Undefined Elastic TOML
Keystrokes Input Capture from a Suspicious Module Undefined Elastic TOML
Keystrokes Input Capture from Suspicious CallStack Undefined Elastic TOML
Keystrokes Input Capture from Unsigned DLL Undefined Elastic TOML
Keystrokes Input Capture via PowerShell Undefined Elastic TOML

+ 1 more from elastic/protections-artifacts → showing the 10 highest-severity

socfortress/Wazuh-Rules

7 rules
Detection Severity Format
Access to potential keylogger file /tmp/.keyboard.log (T1056.001) High Wazuh XML
Keylogging attempt detected via PROMPT_COMMAND (logger with process ID and session info) High Wazuh XML
Keylogging attempt detected via PROMPT_COMMAND (tee to .bash_history) High Wazuh XML
Keylogging attempt using PS2 with logger to .sh_history (T1056.001) High Wazuh XML
Potential auditd keylogger detected via auditctl execve rule with key CMDS High Wazuh XML
Suspicious PAM modification attempt — Possible keylogging configuration (T1056.001) High Wazuh XML
Potential activation of PAM TTY keylogging or auditd manipulation (T1056.001 / T1562.001) Medium Wazuh XML

SigmaHQ/sigma

3 rules
Detection Severity Format
Linux Keylogging with Pam.d High Sigma
Potential Keylogger Activity Medium Sigma
Powershell Keylogging Medium Sigma

chainguard-dev/osquery-defense-kit

3 rules · 2 families
Detection Severity Format
Detects unexpected programs opening files in /dev on Linux 2 variants Undefined osquery SQL
Detects unexpected programs opening files in /dev on Linux 2 variants Undefined osquery SQL
Find programs that are sniffing keyboard events on macOS Undefined osquery SQL

elastic/detection-rules

1 rule
Detection Severity Format
PowerShell Keylogging Script High Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.