Operation Poisson: Python Keylogger Deploying pynput/Keyboard Hook (T1056.001)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the execution of Python scripts that include libraries (pynput, pyxhook) or functions (GetAsyncKeyState, WH_KEYBOARD_LL) frequently used by keyloggers to capture user keystrokes. It also monitors for suspicious input device access and command-line arguments indicative of keystroke monitoring.