Windows Registry: Suspicious Keyboard Layout Preload in User Session
Detects user-hive registry changes that preload Persian (Iranian) or Vietnamese keyboard layouts under Windows.
- Product
- windows
- Category
- registry_set
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-10-12
- Updated
- 2026-07-30
ATT&CK techniques
Resource DevRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Registry writes that include the Keyboard Layout Preload (and Substitutes) paths under the current user hive, with details matching specific layout identifiers (Persian/Iranian and Vietnamese). Loading keyboard layouts via these entries can support attacker interaction by aligning input methods with targeted environments or user expectations. It relies on registry set telemetry capturing TargetObject and Details fields for changes under the \\Keyboard Layout\\Preload and \\Keyboard Layout\\Substitutes locations.
Reporting behind it
- renenyffenegger.chhttps://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index
- github.comhttps://github.com/SwiftOnSecurity/sysmon-config/pull/92/files
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_susp_keyboard_layout_load.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Suspicious Keyboard Layout Preload in User Session"
id: 7dbffcf4-f254-46c6-99c4-11a456fb54ef
status: test
description: This rule flags Registry writes that include the Keyboard Layout Preload (and Substitutes) paths under the current user hive, with details matching specific layout identifiers (Persian/Iranian and Vietnamese). Loading keyboard layouts via these entries can support attacker interaction by aligning input methods with targeted environments or user expectations. It relies on registry set telemetry capturing TargetObject and Details fields for changes under the \\Keyboard Layout\\Preload and \\Keyboard Layout\\Substitutes locations.
references:
- https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index
- https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_susp_keyboard_layout_load.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-10-12
modified: 2023-08-17
tags:
- attack.resource-development
- attack.t1588.002
logsource:
category: registry_set
product: windows
definition: "Requirements: Sysmon config that monitors \\Keyboard Layout\\Preload subkey of the HKLU hives - see https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files"
detection:
selection_registry:
TargetObject|contains:
- \Keyboard Layout\Preload\
- \Keyboard Layout\Substitutes\
Details|contains:
- 429
- 50429
- 0000042a
condition: selection_registry
falsepositives:
- Administrators or users that actually use the selected keyboard layouts (heavily depends on the organisation's user base)
level: medium
license: DRL-1.1
related:
- id: 34aa0252-6039-40ff-951f-939fd6ce47d8
type: derived