StrikeShark Pillager Credential API Hooking via SetWindowsHookEx or GetAsyncKeyState

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

This rule detects potential credential capture by monitoring for unauthorized usage of Windows API functions associated with keyboard hooking, such as SetWindowsHookEx and GetAsyncKeyState. It specifically flags suspicious process activity, such as the execution of the 'Pillager' tool or processes interacting with specific suspicious file paths, while excluding common legitimate processes that routinely perform keyboard hooking.