DETECTING HOTKEY-BASED KEYLOGGERS USING AN UNDOCUMENTED KERNEL DATA STRUCTURE

Summary from the TLDR InfoSec newsletter

Hotkey-based keyloggers register alphanumeric hotkeys that, on keypress, record the keystroke, unregister the hotkey, resend the keypress, and reregister the hotkey. These keyloggers are stealthy since the RegisterHotKey and UnregisterHotKey APIs are not monitored by ETW. In this post, Elastic researchers detail their detection method for hotkey-based keyloggers using an undocumented kernel data structure listing all registered keyloggers' hotkeys.