skills.rest
riparino
riparinoCOMMUNITY
Explore all skills by this author →
GitHub

defensive-keylogger-detection

Detect keylogger activity using YARA rules and API hook detection.

1|Updated Apr 27, 2026
Search Tags:#detection#forensics#incident-response#yara#mde#keylogger
One-click install
npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-keylogger-detection
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: defensive-keylogger-detection
Source: https://github.com/riparino/Claude-Cyber/tree/main/Claude-Blue/Skills/defensive-keylogger-detection
Command: npx skills add https://github.com/riparino/Claude-Cyber --skill defensive-keylogger-detection

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detects and analyzes keylogger activity across endpoints using YARA rules, API hook detection, and registry/hook monitoring to enable rapid triage and incident response.

Core Features & Use Cases

  • YARA-based detection for WH_KEYBOARD_LL hooks and common keylogging patterns.
  • KQL/Sigma-based detection for high-rate keystroke activity and data flow.
  • Use Case: Respond to suspected keylogger on an enterprise endpoint; triage with immediate indicators and recommended remediations.

Quick Start

Prompt Claude to run the YARA-based keylogger detector against the target endpoint and report any matches.

Frequently Asked Questions about defensive-keylogger-detection

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect keylogger activity on Windows endpoints for incident response?▼

Detect keylogger activity by applying YARA rules for WH_KEYBOARD_LL hooks, monitoring keyboard input rates with KQL, and scanning for API hooks to triage suspected enterprise incidents.

What forensic artifacts indicate a keylogger infection?▼

Keylogger forensic artifacts include WH_KEYBOARD_LL hook installations, abnormal keyboard input rates, and malicious API hooks, which YARA and Sigma rules identify during endpoint triage.

Can I use YARA rules to find keyloggers in an enterprise environment?▼

Yes, you can apply YARA rules to target common keylogging patterns and low-level keyboard hooks across enterprise Windows endpoints to rapidly identify malicious activity.

How do I triage a suspected keylogger incident using KQL and Sigma detection?▼

Triage keylogger incidents by running KQL and Sigma patterns to detect high-rate keystroke activity and data flow anomalies, then correlating these artifacts to generate incident reports.

What is the best way to monitor keyboard input for malware forensics?▼

The best way to monitor keyboard input for malware forensics is combining YARA-based API hook detection with KQL queries that flag abnormal keystroke data flows across endpoints.

Does this keylogger detection method support remediation and reporting?▼

Yes, the detection method provides structured guidance for response and remediation, correlating endpoint artifacts to generate comprehensive incident reports for keylogger activity.

Related Skills

Explore More Data & Analytics Skills→
riparinoriparino
1

defensive-shellcode

Detect shellcode in memory using YARA rules and KQL telemetry.

Community
Advanced
YukiIto1999YukiIto1999

analyzing-linux-elf-malware

Classify Linux ELF binaries and extract malware indicators via static and dynamic analysis.

Community
Advanced
copyleftdevcopyleftdev

roth-detection-engineering

Create portable YARA and Sigma threat detection rules for malware hunting.

Community
Intermediate
GhostPWNGhostPWN
4

Malware Analysis & Sandboxing

Extract hashes, strings, imports, and entropy from suspicious binaries.

Official
Advanced