API Hooking Payload for Credential Interception

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects the presence of an API hooking payload within HTTP response data, specifically looking for the strings "SetWindowsHookEx" and "WH_KEYBOARD" (case-insensitive). This combination suggests an attempt to intercept keyboard input, which is a common technique used by malware for credential interception.