PowerShell Script Keylogger (PowerShell)

Source: github.com/anvilogic-forge/armory

Detect PowerShell calls to GetKeyState or GetAsyncKeyState, or known API calls associated with Keylogging

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell
Credential Access	`T1056.001` Input Capture: Keylogging
Collection	`T1056.001` Input Capture: Keylogging

References

https://github.com/samratashok/nishang/blob/master/Gather/Keylogger.ps1

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4103: Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

id: '5743.6020'
title: PowerShell Script Keylogger
description: 'Detect PowerShell calls to GetKeyState or GetAsyncKeyState, or known
  API calls associated with Keylogging - Software Association: VawTrakAtomics T1056.001
  Test #1'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  TERM(EventCode=4104)) ("GetAsyncKeyState" OR "GetKeyState" OR "SetWindowsHookEx"
  OR "getkeyboardstate" OR "Get-Keystrokes") | rex field=Message (?<keyword>"(?i)GetAsyncKeyState|GetKeyState|SetWindowsHookEx|getkeyboardstate|Get-Keystrokes")|
  rex field=process (?<script>"(?i)[A-Za-z0-9-_]+\.ps1") | table _time, host, user
  process, process_*, signature_id, script | bin span=1s | stats values(*) as * by
  _time, host '
techniques:
- execution:command and scripting interpreter:powershell
- credential-access:input capture:keylogging
- collection:input capture:keylogging
technique_id:
- T1059.001
- T1056.001
data_category:
- PowerShell logs
references:
- https://github.com/samratashok/nishang/blob/master/Gather/Keylogger.ps1