Phantom Stealer WH_KEYBOARD_LL Low-Level Keyboard Hook via explorer.exe

Ibrahim Saud@tektrix

•updated Jun 24, 2026•2•0•4

This rule detects attempts to install a keyboard hook (WH_KEYBOARD_LL) using the SetWindowsHookEx API, specifically when the initiating process is 'explorer.exe'. This behavior can be indicative of keylogging activity, where an attacker attempts to capture keystrokes.