Loading story…
Elastic added behavioral Windows keylogger detection to Elastic Defend 8.12, using Event Tracing for Windows (ETW) to observe API activity associated with keystroke collection through polling, keyboard hooks, Raw Input, and DirectInput. Prebuilt endpoint rules identify suspicious use of APIs including GetAsyncKeyState, SetWindowsHookEx, and RegisterRawInputDevices.
In testing on Windows 10, Elastic Defend detected a proof-of-concept Raw Input keylogger soon after it executed, flagging an untrusted process that registered for keyboard input. The telemetry captures API arguments, call-stack context, process-signature status, and related process metadata, enabling defenders to investigate credential- and information-theft activity while reducing false positives from legitimate accessibility and input software.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
In a Windows 10 22H2 test, Elastic Defend detected a proof-of-concept program named Keylogger.exe shortly after it registered for keyboard input through RegisterRawInputDevices. The "Keystroke Input Capture via RegisterRawInputDevices" rule identified the untrusted process's keyboard-capture registration.
Elastic Defend version 8.12 introduced ETW-based behavioral detections for user-space Windows keylogging activity, including suspicious use of GetAsyncKeyState, SetWindowsHookEx, and RegisterRawInputDevices. Elastic also added prebuilt endpoint rules intended to detect polling, keyboard-hook, Raw Input, and DirectInput capture methods without relying on malware signatures.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
malpedia.caad.fkie.fraunhofer.de
Open sourceelastic.co
Open sourceelastic.co
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security 8.11 added a ransomware-response capability that triggers a full memory dump when sticky canary files detect attempted encryption. Elastic Defend stores compressed dumps locally in the protected Endpoint cache rather than sending them to Elastic, enabling responders to preserve volatile evidence from the encrypting process. Elastic demonstrated recovery of an in-memory AES-128 session key from a captured **NotPetya** process dump and showed that, under constrained CPU-affinity conditions, a dumped **WannaCry** process's Windows PRNG state can help predict future per-file AES keys. The capability is intended as a forensic and recovery aid rather than a universal ransomware control, since key handling and encryption behavior differ across families. Separately, Malpedia published an autogenerated YARA rule for the Windows **LockBit** family; it targets files below 2,049,024 bytes and requires at least seven matches from 18 sample-derived byte sequences, providing an additional static-detection option for LockBit artifacts.
Sep 9, 2026
Elastic detailed enhanced Windows user-mode call-stack telemetry in **Elastic Defend** that attributes dual-use behavior to the code that initiated it. The telemetry enriches stack addresses with module exports and identifies the final user module’s path, SHA-256 hash, signature state, memory protections, and provenance, helping analysts identify direct syscalls, proxy execution, shellcode, ROP-like activity, unbacked RWX memory, and truncated or manipulated stacks. Dispatcher functions in captured stacks can also reveal early-thread execution, exception-handler abuse, APC-based execution, and GUI-thread hijacking. The approach addresses a longstanding control-flow defense problem: ordinary stack walking reconstructs return addresses but can be misled by tail calls, trampolines, and stack manipulation. Earlier hardware-assisted CFI research, including Endgame’s HA-CFI, used Intel PMU branch-misprediction traps and Last Branch Record data to validate indirect-call targets and reported detection of ROP and ROPless exploit techniques across tested exploit samples. Elastic’s telemetry-focused implementation makes suspicious control-flow context available in endpoint alerts by default; organizations can also enable it for routine events, balancing additional visibility against increased telemetry volume.
Sep 9, 2026
Elastic Security Labs detailed a Windows keylogging technique that abuses the `RegisterHotKey` API to register individual keys as global hotkeys and collect the resulting `WM_HOTKEY` messages. The Hotkeyz proof of concept temporarily unregisters a captured hotkey, replays the user’s original keystroke via `keybd_event`, re-registers the hotkey, and records its virtual-key code, allowing keystroke collection with little visible disruption. The researchers found that Event Tracing for Windows does not produce telemetry for `RegisterHotKey` or `UnregisterHotKey`, limiting direct API-based detection. They instead created a kernel-driver-based detector that examines the undocumented `gphkHashTable` structure in `win32kfull.sys` for excessive alphanumeric hotkey registrations; registering 36 or more unmodified alphanumeric keys is identified as a likely indicator of hotkey-based keylogging. Elastic released the detector and demonstrated that it detects Hotkeyz.
Sep 9, 2026