AN0243
Analytic 0243
Windows
Monitors suspicious usage of Windows API calls like SetWindowsHookEx, GetKeyState, or polling functions within non-UI service processes, combined with Registry or driver modifications.
WinEventLog:Sysmon
EventCode=10
WinEventLog:Security
EventCode=4663, 4670, 4656
WinEventLog:System
EventCode=7045
WinEventLog:Sysmon
EventCode=13, 14
[TargetImage]
Scope to sensitive GUI/session processes like winlogon.exe or osk.exe
[AccessMask]
Can be tuned to 0x1fffff for full-access injection detection
[TimeWindow]
Tunable for sustained polling or multiple registry edits in short succession
AN0244
Analytic 0244
Linux
Detects non-system processes accessing /dev/input/* or issuing ptrace/evdev syscalls used for reading keystroke buffers directly.
auditd:SYSCALL
open, read
auditd:SYSCALL
ptrace, ioctl
[ProcessName]
Exclude known good applications (e.g. Xorg, GNOME Shell)
[DevicePath]
Typically /dev/input/event*, but tunable to match custom input buses
AN0245
Analytic 0245
macOS
Detects unauthorized TCC access or use of Quartz Event Services (CGEventTapCreate) or IOHID for event tap installation within unexpected processes.
macos:unifiedlog
subsystem=com.apple.TCC
macos:osquery
process_events OR launchd
[Service]
com.apple.inputmonitoring, com.apple.accessibility, etc.
[ExecutablePath]
Tunable to exclude trusted endpoint monitoring tools
AN0246
Analytic 0246
Network Devices
Keylogging on legacy network devices via unauthorized system image modification or remote capture of console keystrokes (telnet, SSH) through altered firmware or man-in-the-middle key sniffing.
networkdevice:syslog
Image Upgrade / Configuration Change
NSM:Flow
packet capture or DPI logs
[FirmwareVersion]
Baseline hash or expected version for config/image integrity
[Protocol]
Scope to plaintext channels or low-assurance SSH versions