PS1Bot Keystroke Hooking

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•4

Detects PowerShell attempting to hook keystrokes via user32.dll SetWindowsHookEx. This behavior is often associated with malware like PS1Bot to capture user input.