PowerShell keylogging via Get-Keystrokes and GetAsyncKeyState on Windows

title: PowerShell keylogging via Get-Keystrokes and GetAsyncKeyState on Windows
id: 71dad7ac-4c63-4663-b914-87376ae6b353
status: test
description: This rule identifies PowerShell scripts that include the Get-Keystrokes function and related key capture logic using GetAsyncKeyState and GetForegroundWindow. Keylogging enables attackers to capture sensitive data as users type, including credentials and other secrets. It relies on Windows PowerShell Script Block logging telemetry where ScriptBlockText contains specific function and Win32 API usage strings.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/src/Get-Keystrokes.ps1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_keylogging.yml
author: frack113, Huntrule Team
date: 2021-07-30
modified: 2022-07-11
tags:
  - attack.credential-access
  - attack.collection
  - attack.t1056.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_basic:
    ScriptBlockText|contains: Get-Keystrokes
  selection_high:
    ScriptBlockText|contains|all:
      - Get-ProcAddress user32.dll GetAsyncKeyState
      - Get-ProcAddress user32.dll GetForegroundWindow
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 34f90d3c-c297-49e9-b26d-911b05a4866c
    type: derived