Millenium RAT/TONResolver WH_KEYBOARD_LL Hook Install by Unsigned/User-Dir Binary
This rule detects the installation of low-level keyboard hooks (WH_KEYBOARD_LL or WH_KEYBOARD) using API calls. It specifically monitors for processes attempting to hook keyboard input from user-writable directories (e.g., Temp, Downloads, AppData) or using unsigned/invalidly signed binaries, which is a common technique used by malware like keyloggers for credential theft.
Microsoft Sentinel (KQL)
