TrymeLocker Keylogging via SetWindowsHookEx WH_KEYBOARD_LL (SetHook/HookCallback)

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

This rule monitors for the usage of the Windows API function 'SetWindowsHookEx' with the hook type 'WH_KEYBOARD_LL' (hook type 13), which is a common technique used by keyloggers and spyware to intercept keystrokes at the system level. The detection triggers when this API call is observed within process execution or API call traces.