Powershell Keylogging

Title: Powershell Keylogging
Status: test
Description:Adversaries may log user keystrokes to intercept credentials as the user types them.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/src/Get-Keystrokes.ps1
Author: frack113
Date: 2021-07-30
modified:2022-07-11
Tags:

• -'attack.credential-access'
• -'attack.collection'
• -'attack.t1056.001'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection_basic:
    ScriptBlockText|contains: 'Get-Keystrokes'
  selection_high:
    ScriptBlockText|contains|all:
      -'Get-ProcAddress user32.dll GetAsyncKeyState'
      -'Get-ProcAddress user32.dll GetForegroundWindow'

  condition:1 of selection_*
Falsepositives:
  -Unknown
Level: medium