AN0282
Analytic 0282
Windows
Monitors for abnormal process behavior and API calls like SetWindowsHookEx, GetAsyncKeyState, or device input polling commonly used for keystroke logging.
WinEventLog:Sysmon
EventCode=10
WinEventLog:Security
EventCode=4663, 4670, 4656
[TargetImage]
Can be scoped to sensitive GUI processes like explorer.exe or winlogon.exe
[TimeWindow]
Time threshold for detecting multiple suspicious accesses
AN0283
Analytic 0283
Linux
Detects use of tools/scripts accessing input devices like /dev/input/* or evdev via suspicious processes lacking GUI context.
auditd:SYSCALL
open, read
auditd:SYSCALL
write
auditd:SYSCALL
ptrace, ioctl
[ProcessName]
Unusual process accessing device files
[DevicePath]
Typically /dev/input/*, but tunable to exact endpoint config
AN0284
Analytic 0284
macOS
Monitors for TCC-bypassing or unauthorized access to input services like IOHIDSystem or Quartz Event Services used in keylogging or screen monitoring.
macos:unifiedlog
subsystem=com.apple.TCC
macos:osquery
launchd or process_events
[Service]
com.apple.accessibility, com.apple.quartz, etc. depending on the API path used
[ParentProcess]
Unusual parent/child pairings can indicate malicious injection
AN0285
Analytic 0285
Network Devices
Detects web-based credential phishing by analyzing traffic to suspicious URLs that mimic login portals and POST credential content.
NSM:Flow
http.log
NSM:Firewall
proxy or TLS inspection logs
[UserAgent]
Mismatched browser identifiers used by phishing kits
[URL_Path]
Paths resembling known login forms but hosted on unknown domains