Keystroke Messages Hooking via SetWindowsHookEx

[rule]
description = """
Identifies attempts to install an application-defined hook procedure to monitor keystroke messages. Adversaries may log
user keystrokes to intercept credentials or other information from the user as the user types them.
"""
id = "7ae180e1-e08f-40c2-82db-f274f688eea2"
license = "Elastic License v2"
name = "Keystroke Messages Hooking via SetWindowsHookEx"
os_list = ["windows"]
reference = [
    "https://attack.mitre.org/techniques/T1056/001/",
    "https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-setwindowshookexa",
    "https://www.elastic.co/security-labs/protecting-your-devices-from-information-theft-keylogger-protection",
]
version = "1.0.19"

query = '''
api where process.Ext.api.name == "SetWindowsHookEx" and process.Ext.api.parameters.hook_type == "WH_KEYBOARD_LL" and
 process.Ext.api.parameters.hook_module == "null" and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and not process.code_signature.status : "trusted" and
 process.thread.Ext.call_stack_summary : "?*" and process.executable != null and
 not process.thread.Ext.call_stack_summary :
                               ("*user32.dll|explorer.exe|user32.dll*",
                                "*user32.dll|tabskb.dll|kernel32.dll*",
                                "*user32.dll|taskbar.dll*",
                                "win32u.dll|user32.dll|pilotshubapp.dll",
                                "*win32u.dll|user32.dll|mtb.exe|mfc90u.dll|mtb.exe*",
                                "win32u.dll|user32.dll|powertoy*",
                                "win32u.dll|user32.dll|rdclientax.dl*",
                                "*qt6gui.dll|qt6core.dll*",
                                "win32u.dll|user32.dll|rwsfoundation_x64.dll|ucrtbase.dll|kernel32.dll|ntdll.dll",
                                "win32u.dll|user32.dll|autohotkey*.exe|kernel32.dll|ntdll.dll") and
 not process.thread.Ext.call_stack_final_user_module.hash.sha256 in
                        ("1683394a15b58815a01bbe030dfc1e441a9b0f7f38d18bd5c13d41d573d58f53",
                         "bec3b34c8e9c04a1da28c623fb06cee45739113a38a1eae52d2a3b208c4baa6f",
                         "0d083e72eb0e8cbcec2c347840bff815513eecf29648065163b08c600f6c95ff",
                         "38011e713b4be8577576062754cad03e9899859488932ae4c9c83e5fbb5cb7d2",
                         "b67e006287fba2278f897d242ff58548b7d6b15ac490a91c26318c6f396da195",
                         "feaf9479260db6f41d1e6443d0d80826eeee4905ef97a1cab78c16bc304248a5",
                         "465d3985e1dd8bc69137e2a8c5a4a6ba16b0ff99c647245ca66942750ccc75ef",
                         "549888a9e268dd5ca6544cabc8266148ff0d8728c3aa0f1c68f9f8bcb116e53d") and
 not process.thread.Ext.call_stack_final_user_module.path :
                        ("?:\\Program Files\\*",
                         "?:\\Program Files (x86)\\*",
                         "?:\\windows\\system32\\*",
                         "?:\\windows\\syswow64\\*",
                         "\\Program Files\\*",
                         "\\Program Files (x86)\\*",
                         "\\windows\\system32\\*",
                         "\\windows\\syswow64\\*",
                         "?:\\windows\\explorer.exe",
                         "\\windows\\explorer.exe",
                         "*\\windows\\systemapps\\*",
                         "c:\\windows\\microsoft.net\\framework*\\clr.dll",
                         "*\\windows\\assembly\\*",
                         "?:\\windows\\systemapps\\*.dll",
                         "?:\\Windows\\WinSxS\\*.dll",
                         "?:\\windows\\assembly\\*.dll",
                         "\\windows\\systemapps\\*.dll",
                         "\\Windows\\WinSxS\\*.dll",
                         "\\windows\\assembly\\*.dll",
                         "\\windows\\shellexperiences\\*.dll",
                         "?:\\progra~?\\citrix\\icacli~?\\vdkbhook.dll",
                         "?:\\windows\\shellexperiences\\*.dll",
                         "\\windows\\shellexperiences\\*.dll",
                         "?:\\windows\\jmesoft\\keyhook.dll",
                         "?:\\users\\*\\appdata\\local\\microsoft\\teams\\current\\d3dcompiler_??.dll",
                         "\\device\\mup\\*",
                         "?:\\windows\\immersivecontrolpanel\\systemsettings.dll") and
    not process.thread.Ext.call_stack_final_user_module.name : ("Unknown", "Undetermined") and
    not process.thread.Ext.call_stack_final_user_module.protection_provenance : ("hmpalert.dll", "kernel") and
    not process.executable :
                ("?:\\Program Files\\workspacer\\workspacer.exe",
                 "?:\\Program Files (x86)\\Do It Again\\DoItAgain.exe",
                 "?:\\Program Files (x86)\\HP\\HP LaserJet Pro MFP *\\bin\\HPScan.exe",
                 "?:\\Program Files (x86)\\Avaya\\Avaya IX Workplace\\fTarget\\Avaya.BrowserExtension.exe") and
    not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.status : "trusted")
'''

min_endpoint_version = "8.12.0"
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1056"
name = "Input Capture"
reference = "https://attack.mitre.org/techniques/T1056/"
[[threat.technique.subtechnique]]
id = "T1056.001"
name = "Keylogging"
reference = "https://attack.mitre.org/techniques/T1056/001/"



[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[internal]
min_endpoint_version = "8.12.0"