AN0687
Analytic 0687
Windows
Behavior chain involving unexpected API calls to capture keyboard input, driver loads for keyloggers, or remote use of smart card authentication via logon sessions not initiated by local user interaction
WinEventLog:Sysmon
EventCode=10
WinEventLog:Security
EventCode=4624, 4648
WinEventLog:Sysmon
EventCode=13, 14
[AccessMask]
Tunable based on what memory-level access the keylogger uses (e.g., 0x10 for read)
[ProcessNameExclusions]
Legitimate accessibility tools may use similar API calls (e.g., Magnifier.exe)
[TimeWindow]
Define how quickly access + registry mod + smart card use must co-occur
AN0688
Analytic 0688
Linux
Detection of unauthorized keylogger behavior through access to `/dev/input`, loading kernel modules (e.g., via insmod), or polling user input devices from non-user shells
linux:syslog
syscalls (open, read, ioctl) on /dev/input or /proc/*/fd/*
linux:syslog
dmesg or syslog for module loads
[PathTarget]
Can tune based on device paths accessed for keyboard input (e.g., /dev/input/event0)
[UserContext]
Exclude root or admin-auth shell sessions if needed
[ModuleWhitelist]
Set a known list of allowed kernel modules
AN0689
Analytic 0689
macOS
Processes accessing TCC-protected input APIs or polling HID services without user interaction, or dynamically loaded keylogging frameworks using accessibility privileges
macos:unifiedlog
com.apple.securityd, com.apple.tccd
macos:osquery
query: process_events, launchd, and tcc.db access
[AccessibilityAPIUsage]
Detection of programs requesting access to input monitoring (e.g., CGEventTap)
[TCCBypassAttempt]
Alert if TCC settings are altered or bypassed
[SignedBinaryCheck]
Tunable based on developer signing status (legitimate software vs unsigned)