VxKeypress1212

Hunt Hypothesis

This detection identifies potential keylogging or credential harvesting activities by monitoring specific keystroke patterns associated with the VxKeypress1212 signature across endpoint devices. Proactively hunting for this behavior in Azure Sentinel allows the SOC team to uncover stealthy data exfiltration attempts that may evade standard alerting thresholds due to their low severity classification.

YARA Rule

rule VxKeypress1212
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] E8 [2] E8 [2] E8 [4] E8 [4] E8 [4] EA [4] 1E 33 DB 8E DB BB }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the VxKeypress1212 detection rule, including suggested filters and exclusions:

• Scenario: Remote Desktop Administration via RDP

  • Context: System Administrators frequently use Microsoft Remote Desktop (mstsc.exe) to manage servers. The YARA rule may flag the continuous stream of simulated keystrokes generated by the RDP client as suspicious keylogging activity, especially when admins are typing commands or copying data into remote sessions.
  • Filter/Exclusion: Add an exclusion for processes where ImageName is mstsc.exe and the parent process is a user-interactive session (e.g., SessionId > 1). Alternatively, exclude events where the CommandLine contains /v: or /admin.

• Scenario: Automated Password Reset Scripts

  • Context: IT operations often deploy scheduled PowerShell scripts (Task Scheduler) to reset service account passwords or update configuration files. These scripts may utilize libraries like System.Windows.Forms.SendKeys or P/Invoke calls to simulate keystrokes, triggering the rule during maintenance windows.
  • Filter/Exclusion: Create a filter excluding events where the process name is powershell.exe and the parent process is svchost.exe (indicating a scheduled task). Specifically, exclude if the command line contains keywords like -Command, “TaskScheduler”, or specific script paths (e.g., C:\Scripts\AutoReset.ps1).

• Scenario: Enterprise Endpoint DLP Agents

  • Context: Data Loss Prevention (DLP) agents such as Symantec DLP, McAfee Total Protection, or Forcepoint often hook into the keyboard input stream to scan data in real-time. The VxKeypress1212 rule may misinterpret these internal hooks and background scanning processes as external keylogging attempts