Operation Poisson Python Keylogger via pynput Writing Keystrokes to Local File
Detects the execution of Python processes with command-line arguments indicative of keylogging activity (e.g., pynput, keyboard, keylog) or Python processes creating/writing to files with names suggesting keylogging behavior (e.g., log.txt, keylog). This rule targets potential data collection via keyboard interception by monitoring process creation and file write events.
Splunk (SPL)
