RatHat UniversalInputMonitor Accessibility Keylogger Activity

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•2

This rule detects activities related to potential keylogging or unauthorized input monitoring on Android devices. It flags processes, classes, or raw log data associated with 'UniversalInputMonitor' and monitors for keywords commonly used in password or PIN input fields, or when Android accessibility services interact with masked input fields.