Potential PowerShell Keylogger Activity via IsKeyDown

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•33

Detects PowerShell scripts that contain references to the .NET `[System.Windows.Input.Keyboard]::IsKeyDown` function, which can be used for keystroke capturing. This function checks if a specified key is pressed, making it a common indicator of potential keylogger activity within PowerShell scripts.