From 9e4cc2826585d1c939aee25df5067330937d7655 Mon Sep 17 00:00:00 2001 From: Zeze Date: Tue, 28 Oct 2025 23:20:39 +0800 Subject: [PATCH] feat: log keystrokes via rawinput (#1078) * feat: log keystrokes via directx * fix: williballenthin review * move register-raw-input-devices from nursery * use original rule name --- .../keylog}/register-raw-input-devices.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) rename {nursery => collection/keylog}/register-raw-input-devices.yml (55%) diff --git a/nursery/register-raw-input-devices.yml b/collection/keylog/register-raw-input-devices.yml similarity index 55% rename from nursery/register-raw-input-devices.yml rename to collection/keylog/register-raw-input-devices.yml index 2e5cb96d..3a0b2dd8 100644 --- a/nursery/register-raw-input-devices.yml +++ b/collection/keylog/register-raw-input-devices.yml @@ -1,13 +1,17 @@ -# generated using capa explorer for IDA Pro rule: meta: name: register raw input devices - namespace: host-interaction/hardware + namespace: collection/keylog authors: + - zeze-zeze - michael.hunhoff@mandiant.com scopes: static: basic block dynamic: call + att&ck: + - Collection::Input Capture::Keylogging [T1056.001] + examples: + - 52d8e95c9883cd16d7b44e3a7adc22d6.exe_ features: - or: - api: user32.RegisterRawInputDevices