1. What Is a Keylogger?
A keylogger is a surveillance tool that captures keyboard input (and often related user activity) to collect sensitive data such as credentials, messages, or commands. Keyloggers are commonly observed as a capability within broader malware families rather than as standalone tools.
From a defender’s perspective, keyloggers matter because:
- They enable credential theft and lateral movement
- They often bypass traditional perimeter controls
- They can operate with low noise over long dwell times
2. Keylogger Taxonomy (Defensive View)
2.1 Hardware Keyloggers
Physical devices inserted between the keyboard and the host system.
- USB inline devices
- Embedded keyboard firmware implants
- Wireless keyboard sniffers
Defensive characteristics
- Not visible to the operating system
- Detected via physical inspection or USB device inventory anomalies
2.2 Software Keyloggers
Malicious code executing on the host OS.
a. User-Mode Keyloggers
- API hooking of keyboard input functions
- Event-based capture via message loops
- Clipboard and window title harvesting
b. Kernel-Mode Keyloggers
- Keyboard driver interception
- Filter drivers attached to input stacks
- Extremely stealthy, higher impact
c. Browser-Focused Keyloggers
- JavaScript injection
- Form-grabbing prior to TLS encryption
- Browser extension abuse
3. Keylogger Data Collection Surfaces
Keyloggers rarely capture only keystrokes. Common telemetry collected includes:
| Surface | Description |
|---|---|
| Keystrokes | Raw scancodes or character streams |
| Window Titles | Context for typed data |
| Clipboard | Copied passwords, tokens |
| Screenshots | Triggered on input events |
| Browser Forms | Username/password pairs |
| Application Focus | Identifies credential sources |
4. Keylogger Execution & Persistence (High-Level)
This section is observational, not instructional.
Execution
- Loaded as part of a trojanized binary
- Injected into long-lived user processes
- Launched via scheduled or auto-start mechanisms
Persistence
- Registry auto-start entries
- Scheduled execution hooks
- Service or driver registration
- Abuse of accessibility features (e.g., input helpers)
5. Indicators of Compromise (IOCs)
IOCs for keyloggers are behavioral first, not signature-based. Static indicators alone are unreliable.
5.1 Host-Based IOCs
Process & Memory
- Unexpected processes accessing keyboard APIs
- Untrusted modules injected into GUI processes
- High-frequency access to input-related libraries
File System
- Encrypted or obfuscated log files
- Rapid small write operations
- Files updated only during user activity
Registry / Configuration
- Auto-start entries referencing unsigned binaries
- Driver load entries without vendor attribution
5.2 Behavioral IOCs
- Input capture continues during idle user sessions
- Correlation between typing activity and outbound traffic
- Periodic data exfiltration bursts following user login
5.3 Network IOCs
- Low-volume, high-frequency outbound traffic
- Exfiltration shortly after credential entry
- Use of non-standard ports for beaconing
- Encrypted traffic to newly registered domains
6. Detection Strategies
Endpoint Detection
- Monitor API call patterns (input capture, window focus)
- Kernel driver integrity validation
- Process injection heuristics
EDR / XDR Correlation
- Tie user input events to network activity
- Flag keyboard access by non-UI applications
Threat Hunting Queries
- Processes accessing keyboard input without UI rendering
- DLL loads inconsistent with application function
- Drivers attached to keyboard class stacks
7. Incident Response (IR) for Keylogger Infections
7.1 Identification
- Confirm keystroke capture capability
- Identify affected users and systems
- Assess credential exposure window
7.2 Containment
- Isolate affected hosts from the network
- Disable compromised accounts
- Block suspected exfiltration endpoints
7.3 Eradication
- Remove malicious binaries and persistence
- Rebuild systems if kernel compromise is suspected
- Validate clean input stacks and drivers
7.4 Recovery
- Reset all credentials entered on affected systems
- Re-issue tokens, certificates, and API keys
- Monitor for re-infection attempts
7.5 Lessons Learned
- Identify detection gaps
- Harden endpoint monitoring
- Improve credential hygiene and MFA coverage
8. Common Mistakes in Keylogger Response
- Treating keyloggers as “low severity”
- Relying only on antivirus signatures
- Failing to rotate all credentials
- Ignoring browser-stored secrets
9. IOC Reference Table (Summary)
| Category | Indicator Type | Examples |
|---|---|---|
| Process | Behavioral | Non-UI process accessing keyboard APIs |
| Memory | Injection | Unsigned modules in GUI processes |
| File System | Artifact | Encrypted keystroke logs |
| Registry | Persistence | Auto-start entries with no vendor |
| Driver | Kernel | Unknown keyboard filter drivers |
| Network | Exfiltration | Small periodic encrypted uploads |
| User Behavior | Correlation | Network bursts after typing activity |
10. Final Notes
Keyloggers are impact multipliers rather than isolated threats. Their real danger lies in what they enable: credential theft, privilege escalation, and long-term access. Effective defense requires behavioral detection, strong IR discipline, and credential lifecycle management.
