TrymeLocker WH_KEYBOARD_LL Keylogger Hook by Unsigned .NET Process

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects suspicious unsigned processes that load user32.dll (often for API hooking) while concurrently writing data to files in temporary or application data directories (consistent with keylogging dump patterns). This rule targets non-system binaries originating from user-writable paths that exhibit combined module loading and file output behaviors typical of keylogger malware like TrymeLocker.