Suspicious Keyboard Layout Load (via registry_set)

title: Suspicious Keyboard Layout Load (via registry_set)
id: 644832ef-36b9-5d43-8c5b-b70227aeb73f
status: stable
description: This rule detects the keyboard preload installation with an anomalous keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only
references:
    - https://attack.mitre.org/techniques/T1588/002/
    - https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index
    - https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files
author: Huntrule Team
date: 2026-04-11
tags:
    - attack.resource-development
    - attack.t1588.002
logsource:
    category: registry_set
    product: windows
    definition: 'Requirements: Sysmon config that monitors \Keyboard Layout\Preload subkey of the HKLU hives - see https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files'
detection:
    selection_registry:
        TargetObject|contains:
            - '\Keyboard Layout\Preload\'
            - '\Keyboard Layout\Substitutes\'
        Details|contains:
            - 00000429
            - 00050429
            - 0000042a
    condition: selection_registry
falsepositives:
    - Unknown
level: medium