Windows Keylogger Detection: Targeting Past & Present Keylogging Techniques
summary
EDR feature monitors manifest ETW provider Microsoft‑Windows‑Win32k and reliably captures three API events used by keyloggers: GetAsyncKeyState, SetWindowsHookEx, and RegisterRawInputDevices. Detection rules flag backgroundCallCount >= 400, hook filter type 13 (low‑level keyboard), or RIDEV_INPUTSINK raw‑input flags. For hotkey keyloggers a kernel driver locates gpk hash table in win32kfull.sys via instruction signatures, KeStackAttachProcess reaches session memory, and scanning shows when all alphanumeric keys are registered as RegisterHotKey — detector raises an alert in demos.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:05What is a keylogger
- 3:14Keylogger types overview
- 5:42How keyloggers work
- 10:00Behavior-based detection in EDR
- 15:37Demo: API monitoring tool
- 20:29Detection rules for keyloggers
- 24:25Detecting hook-based keyloggers
- 30:37Building the detection tool
- 34:18Demo: Hook-based detector
- 35:23Q&A
related talks
38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-Exploitation
39mI Watched You Roll the Die: Unparalleled RDP Monitoring Reveal Attackers' Tradecraft
56mWindows Kernel Graphics Driver Attack Surface
29mHunting and Stopping Threats with Elastic Security
44mEvent Tracing for Windows Internals
37mHi, My Name Is Keyboard
42mE-Meet (or Emit?) My Keystrokes: How Benign Screen-sharing Meetings Could Leak Typing Behaviors
30mCommSec D1 - Keynterceptor: Press Any Key to Continue