Monitors for abnormal process behavior and API calls like SetWindowsHookEx, GetAsyncKeyState, or device input polling commonly used for keystroke logging.
| Data Component | Name | Channel |
|---|---|---|
| Process Access (DC0035) | WinEventLog:Sysmon | EventCode=10 |
| File Access (DC0055) | WinEventLog:Security | EventCode=4656 |
| Field | Description |
|---|---|
| TargetImage | Can be scoped to sensitive GUI processes like explorer.exe or winlogon.exe |
| TimeWindow | Time threshold for detecting multiple suspicious accesses |
Detects use of tools/scripts accessing input devices like /dev/input/* or evdev via suspicious processes lacking GUI context.
| Data Component | Name | Channel |
|---|---|---|
| File Access (DC0055) | auditd:SYSCALL | open, read |
| File Modification (DC0061) | auditd:SYSCALL | write |
| OS API Execution (DC0021) | auditd:SYSCALL | ptrace, ioctl |
| Field | Description |
|---|---|
| ProcessName | Unusual process accessing device files |
| DevicePath | Typically /dev/input/*, but tunable to exact endpoint config |
Monitors for TCC-bypassing or unauthorized access to input services like IOHIDSystem or Quartz Event Services used in keylogging or screen monitoring.
| Data Component | Name | Channel |
|---|---|---|
| Process Metadata (DC0034) | macos:unifiedlog | subsystem=com.apple.TCC |
| Process Creation (DC0032) | macos:osquery | launchd or process_events |
| Field | Description |
|---|---|
| Service | com.apple.accessibility, com.apple.quartz, etc. depending on the API path used |
| ParentProcess | Unusual parent/child pairings can indicate malicious injection |
Detects web-based credential phishing by analyzing traffic to suspicious URLs that mimic login portals and POST credential content.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Flow | http.log |
| Network Connection Creation (DC0082) | NSM:Firewall | proxy or TLS inspection logs |
| Field | Description |
|---|---|
| UserAgent | Mismatched browser identifiers used by phishing kits |
| URL_Path | Paths resembling known login forms but hosted on unknown domains |