LxBaseRAT keylogger module using WH_KEYBOARD_LL/GetAsyncKeyState/StartKeylogger
Detects the presence of API strings and function names in EDR telemetry associated with the LxBaseRAT keylogging module. The rule monitors for the usage of low-level keyboard hooks (WH_KEYBOARD_LL) and state polling functions (GetAsyncKeyState, GetKeyboardState) commonly used by malicious software to capture user input.
Sigma
