Potential Keylogger Installation via Command Line
This rule detects suspicious process creations where the command line contains keywords indicative of keylogger activity (e.g., 'keylog', 'keystroke', 'inputmanipulator', 'spyware') combined with installation-related keywords (e.g., 'install', 'create', 'load', 'run'). It aggregates these events by computer and user over one-hour intervals to identify potential keylogger installation attempts.
Microsoft Sentinel (KQL)
