Keystrokes Input Capture from a Managed Application

[rule]
description = """
Identifies attempts to enumerate the state of keyboard keys and the call is coming from a suspicious Microsoft .NET
application. Adversaries may log user keystrokes to intercept credentials or other information from the user as the user
types them.
"""
id = "92243752-7639-45c2-b416-6072b04d2320"
license = "Elastic License v2"
name = "Keystrokes Input Capture from a Managed Application"
os_list = ["windows"]
reference = [
    "https://attack.mitre.org/techniques/T1056/001/",
    "https://www.elastic.co/security-labs/protecting-your-devices-from-information-theft-keylogger-protection",
]
version = "1.0.7"

query = '''
sequence by process.entity_id with maxspan=1m
[process where event.action == "start" and
 (process.Ext.relative_file_creation_time <= 500 or process.Ext.relative_file_name_modify_time <= 500) and
 (process.code_signature.trusted == false or process.code_signature.exists == false) and
 not user.id : ("S-1-5-18", "S-1-5-19", "S-1-5-20") and
 not process.parent.executable : "C:\\Program Files\\Microsoft Visual Studio\\*\\Common?\\IDE\\devenv.exe"]
[api where
 (
  process.Ext.api.name : "GetAsyncKeyState" or
  (process.Ext.api.name == "SetWindowsHookEx" and process.Ext.api.parameters.hook_type == "WH_KEYBOARD_LL")
  ) and
  process.thread.Ext.call_stack_final_user_module.protection_provenance : "clr.dll" and 
  process.thread.Ext.call_stack_final_user_module.name : "Unbacked" and 
  not process.executable : 
                   ("?:\\Program Files (x86)\\*.exe", 
                    "?:\\Program Files\\*.exe", 
                    "C:\\Makino Client\\Product\\SystemConsole.exe")]
'''

min_endpoint_version = "8.10.0"
reputation = true
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1056"
name = "Input Capture"
reference = "https://attack.mitre.org/techniques/T1056/"
[[threat.technique.subtechnique]]
id = "T1056.001"
name = "Keylogging"
reference = "https://attack.mitre.org/techniques/T1056/001/"



[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[internal]
min_endpoint_version = "8.10.0"