Keylogging

Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for substantial period of time before credentials can be successfully captured.

Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes. Some methods include:

· Hooking API callbacks used for processing keystrokes. Unlike Credential API Hooking, this focuses solely on API functions intended for processing keystroke data.

· Reading raw keystroke data from the hardware buffer.

· Windows Registry modifications.

· Custom drivers.

· Modify System image may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.

Example:

In this Demo I will use a simple PowerShell Keylogger. To demonstrate that though this technique is very well known it is still reliable in it's ow way, and with the implementation of using PowerShell this can be run completely in memory. We just need to be aware that this script will log the keystrokes but will create a file on Disk with all the inputs. This needs to be cancelled so the file is created.

We will import the script into out PowerShell session and start running the module.

Once we cancel a notepad will open with all the keystrokes done during the time running.

Of course this isn't OPSEC Safe but it is a simple demonstration of a Keylogger, there are many varieties of this technique out there written in many languages (C, C++, C#, ETC)