PowerShell Script Keylogger Indicators via Keyboard State References (Windows)

title: PowerShell Script Keylogger Indicators via Keyboard State References (Windows)
id: 0b5d2ccc-0d6f-455d-a7cf-b6b11f175977
status: test
description: This rule flags PowerShell script block content that references .NET keyboard state checks using [Windows.Input.Keyboard]::IsKeyDown with [System.Windows.Input.Key]. Attackers can use these calls to determine which keys are pressed as part of keystroke capture or monitoring workflows. The detection relies on script block logging telemetry that includes the script text for matching this specific function reference.
references:
  - https://twitter.com/ScumBots/status/1610626724257046529
  - https://www.virustotal.com/gui/file/d4486b63512755316625230e0c9c81655093be93876e0d80732e7eeaf7d83476/content
  - https://www.virustotal.com/gui/file/720a7ee9f2178c70501d7e3f4bcc28a4f456e200486dbd401b25af6da3b4da62/content
  - https://learn.microsoft.com/en-us/dotnet/api/system.windows.input.keyboard.iskeydown?view=windowsdesktop-7.0
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_keylogger_activity.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-04
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1056.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: "[Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::"
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 965e2db9-eddb-4cf6-a986-7a967df651e4
    type: derived