Detection rules › Splunk
Processes Tapping Keyboard Events
The following analytic detects processes on macOS systems that are tapping keyboard events, potentially monitoring all keystrokes made by a user. It leverages data from osquery results within the Alerts data model, focusing on specific process names and command lines. This activity is significant as it is a common technique used by Remote Access Trojans (RATs) to log keystrokes, posing a serious security risk. If confirmed malicious, this could lead to unauthorized access to sensitive information, including passwords and personal data, compromising the integrity and confidentiality of the system.
Rule body splunk
name: Processes Tapping Keyboard Events
id: 2a371608-331d-4034-ae2c-21dda8f1d0ec
version: 12
creation_date: '2020-04-29'
modification_date: '2026-05-13'
author: Jose Hernandez, Splunk
status: experimental
type: TTP
description: The following analytic detects processes on macOS systems that are tapping keyboard events, potentially monitoring all keystrokes made by a user. It leverages data from osquery results within the Alerts data model, focusing on specific process names and command lines. This activity is significant as it is a common technique used by Remote Access Trojans (RATs) to log keystrokes, posing a serious security risk. If confirmed malicious, this could lead to unauthorized access to sensitive information, including passwords and personal data, compromising the integrity and confidentiality of the system.
data_source:
- Osquery Results
search: |-
| from datamodel Alerts.Alerts
| search app=osquery:results name=pack_osx-attacks_Keyboard_Event_Taps
| rename columns.cmdline as cmd, columns.name as process_name, columns.pid as process_id
| dedup host,process_name
| table host,process_name, cmd, process_id
| `processes_tapping_keyboard_events_filter`
how_to_implement: In order to properly run this search, Splunk needs to ingest data from your osquery deployed agents with the [osx-attacks.conf](https://github.com/facebook/osquery/blob/experimental/packs/osx-attacks.conf#L599) pack enabled. Also the [TA-OSquery](https://github.com/d1vious/TA-osquery) must be deployed across your indexers and universal forwarders in order to have the osquery data populate the Alerts data model.
known_false_positives: There might be some false positives as keyboard event taps are used by processes like Siri and Zoom video chat, for some good examples of processes to exclude please see [this](https://github.com/facebook/osquery/pull/5345#issuecomment-454639161) comment.
references: []
finding:
title: Keyboard Event Tapping observed on $host$
entity:
field: host
type: system
score: 50
analytic_story:
- ColdRoot MacOS RAT
- APT37 Rustonotto and FadeStealer
asset_type: Endpoint
mitre_attack_id: []
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
category: endpoint
security_domain: threat
Stages and Predicates
Stage 1: search
| from datamodel Alerts.Alerts
Stage 2: search
| search app=osquery:results name=pack_osx-attacks_Keyboard_Event_Taps
Stage 3: rename
| rename columns.cmdline as cmd, columns.name as process_name, columns.pid as process_id
Stage 4: dedup
| dedup host,process_name
Stage 5: table
| table host,process_name, cmd, process_id
Stage 6: search
| `processes_tapping_keyboard_events_filter`
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | from |
| 1 | datamodel |
| 1 | Alerts.Alerts |