PowerShell Keylogging via Get-Keystrokes and Win32 API Calls (GetAsyncKeyState, GetForegroundWindow)
Flags PowerShell script blocks containing Get-Keystrokes with GetAsyncKeyState/GetForegroundWindow for potential keylogging.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-07-30
- Updated
- 2026-07-31
ATT&CK techniques
Cred Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell scripts that include the Get-Keystrokes function and use Win32 API calls commonly associated with monitoring keyboard state and foreground window context. Such activity can enable attackers to capture user input and potentially intercept credentials as they are typed. Detection relies on Script Block Logging telemetry containing the relevant PowerShell text patterns and API call strings within the executed script block.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/src/Get-Keystrokes.ps1
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_keylogging.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Keylogging via Get-Keystrokes and Win32 API Calls (GetAsyncKeyState, GetForegroundWindow)
id: 71dad7ac-4c63-4663-b914-87376ae6b353
status: test
description: This rule identifies PowerShell scripts that include the Get-Keystrokes function and use Win32 API calls commonly associated with monitoring keyboard state and foreground window context. Such activity can enable attackers to capture user input and potentially intercept credentials as they are typed. Detection relies on Script Block Logging telemetry containing the relevant PowerShell text patterns and API call strings within the executed script block.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/src/Get-Keystrokes.ps1
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_keylogging.yml
author: frack113, Huntrule Team
date: 2021-07-30
modified: 2022-07-11
tags:
- attack.credential-access
- attack.collection
- attack.t1056.001
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_basic:
ScriptBlockText|contains: Get-Keystrokes
selection_high:
ScriptBlockText|contains|all:
- Get-ProcAddress user32.dll GetAsyncKeyState
- Get-ProcAddress user32.dll GetForegroundWindow
condition: 1 of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 34f90d3c-c297-49e9-b26d-911b05a4866c
type: derived