PowerShell-Based Keylogging Detection

Adversaries often use PowerShell to execute memory-resident keylogging scripts as a means of credential harvesting. By leveraging P/Invoke via Get-ProcAddress to access low-level Windows APIs such as GetAsyncKeyState and GetForegroundWindow from user32.dll, attackers can capture input from the active window. This technique allows for stealthy keystroke interception without dropping traditional malware binaries to disk, making script block logging essential for visibility. This brief provides detection logic for identifying these specific PowerShell patterns, which are often used in the post-exploitation phase to exfiltrate passwords, PINs, or sensitive session data.

Impact

Successful deployment of keylogging scripts leads to the unauthorized capture of plaintext credentials, including administrative passwords and multi-factor authentication codes. This compromises the integrity of individual workstations and provides attackers with lateral movement capabilities within the network.

Recommendation

Detection engineering teams should focus on script visibility and monitoring of suspicious API usage within PowerShell environments.

• Enable PowerShell Script Block Logging (Event ID 4104) across all Windows endpoints to capture the full command execution context.
• Deploy the provided Sigma rule to identify script blocks containing references to user32.dll API calls or known keylogging script identifiers.
• Monitor for high-frequency or background PowerShell process activity that does not correlate with known administrative maintenance windows or deployment scripts.