Keystroke Input Capture via RegisterRawInputDevices

[rule]
description = """
Identifies attempts to register for input from the keyboard using RegisterRawInputDevices API. Adversaries may log user
keystrokes to intercept credentials or other information from the user as the user types them.
"""
id = "4dbb9dfb-b3e2-49d7-8919-d6f221526df4"
license = "Elastic License v2"
name = "Keystroke Input Capture via RegisterRawInputDevices"
os_list = ["windows"]
reference = [
    "https://attack.mitre.org/techniques/T1056/001/",
    "https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-registerrawinputdevices",
    "https://www.cyberbit.com/endpoint-security/hawkeye-malware-keylogging-technique/",
    "https://www.elastic.co/security-labs/protecting-your-devices-from-information-theft-keylogger-protection",
]
version = "1.0.15"

query = '''
api where
 process.Ext.api.name == "RegisterRawInputDevices" and not process.code_signature.status : "trusted" and
 process.Ext.api.parameters.usage == "KEYBOARD" and
 process.Ext.api.parameters.flags like "*INPUTSINK*" and process.thread.Ext.call_stack_summary : "?*" and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and process.executable != null and
 not process.thread.Ext.call_stack_final_user_module.path :
                         ("*\\program files*", "*\\windows\\system32\\*", "*\\windows\\syswow64\\*",
                          "*\\windows\\systemapps\\*",
                          "*\\users\\*\\appdata\\local\\*\\kumospace.exe",
                          "*\\users\\*\\appdata\\local\\microsoft\\teams\\current\\teams.exe") and 
 not process.executable : ("?:\\Program Files\\*.exe", "?:\\Program Files (x86)\\*.exe") and 
 process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                                       ("2e2dc7f8da5e1cc8510e0b3724dc4448a693f3fb76891cea7be5973aa9d94034",
                                        "9e039448344e4f70122a9cb2416cf282d26033ec8a81b3084c8e7076e3242d8b")
'''

min_endpoint_version = "8.12.0"
optional_actions = []
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1056"
name = "Input Capture"
reference = "https://attack.mitre.org/techniques/T1056/"
[[threat.technique.subtechnique]]
id = "T1056.001"
name = "Keylogging"
reference = "https://attack.mitre.org/techniques/T1056/001/"



[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[internal]
min_endpoint_version = "8.12.0"