Operation Poisson Python Keylogger Execution via pynput or win32api Hook

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects the execution of Python scripts on Windows that utilize keyboard hooking libraries or APIs (pynput, GetAsyncKeyState, SetWindowsHookEx) characteristic of keylogging behavior. The rule specifically excludes known development environments to reduce false positives.