Keyboard class filter driver registered under the class key

Siemphony@siemphonyhighT1056.001unverifiedPlaybook · Privilege escalation

A kernel-mode keylogger reads keystrokes by inserting itself into the keyboard device stack, which means writing its service name into the UpperFilters or LowerFilters value of the keyboard class key {4D36E96B-E325-11CE-BFC1-08002BE10318}. This rule is the registry-and-driver half of MITRE's analytic; the API half it opens with (SetWindowsHookEx, GetKeyState, polling loops) is not observable in any log source the strategy lists, because none of them record API calls and a global hook installation produces no process-access event either. The match is on the class key path alone, so it fires on any write to the filter list and cannot tell which driver was added — Sysmon renders a REG_MULTI_SZ value as "Binary Data" in Details, so the new entry is not in the event. Sysmon registry events are also not collected unless the running configuration includes this path; the widely used community configurations filter most of HKLM out. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0089, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Keyboard class filter driver registered under the class key2id: e0be112a-7e06-4413-98e3-6db79c45c84c3status: experimental4description: |5  A kernel-mode keylogger reads keystrokes by inserting itself into the keyboard6  device stack, which means writing its service name into the UpperFilters or7  LowerFilters value of the keyboard class key {4D36E96B-E325-11CE-BFC1-08002BE10318}.8  This rule is the registry-and-driver half of MITRE's analytic; the API half it9  opens with (SetWindowsHookEx, GetKeyState, polling loops) is not observable in10  any log source the strategy lists, because none of them record API calls and a11  global hook installation produces no process-access event either. The match is12  on the class key path alone, so it fires on any write to the filter list and13  cannot tell which driver was added — Sysmon renders a REG_MULTI_SZ value as14  "Binary Data" in Details, so the new entry is not in the event. Sysmon registry15  events are also not collected unless the running configuration includes this16  path; the widely used community configurations filter most of HKLM out.17  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0089, not hand-written and not tested by its author. Any lab result is on this rule's own page.18references:19  - https://attack.mitre.org/techniques/T1056/00120  - https://attack.mitre.org/detectionstrategies/DET008921author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)22date: 2026-08-1623tags:24  - attack.collection25  - attack.credential-access26  - attack.t1056.00127logsource:28  category: registry_set29  product: windows30detection:31  selection:32    TargetObject|contains:33      - '\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}\UpperFilters'34      - '\Control\Class\{4D36E96B-E325-11CE-BFC1-08002BE10318}\LowerFilters'35  condition: selection36falsepositives:37  - "OEM keyboard, hotkey and touchpad packages, which write the filter list while installing or updating their driver. This is the largest source of benign hits, and it clusters in imaging and driver-update windows rather than appearing continuously, so the change window is what separates it from adversary activity rather than anything in the event."38  - "Virtualisation guest additions, VDI and remote-access agents, which install a keyboard filter so that input can be redirected into the session. These appear once per build on the affected fleet."39  - "Security and accessibility products that legitimately own the keyboard stack — anti-keylogger and credential-guard style agents, kiosk lockdown software, on-screen keyboards, smartcard and biometric middleware. A keystroke-encrypting security agent is structurally the same registration as a keylogger."40  - "Because Sysmon reports a multi-string value as binary data, a write that merely reorders or removes existing entries is indistinguishable from one that adds a driver, and the rule alerts on both. Pair this with the service-creation event for the named driver before treating a hit as confirmed."41level: high

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where (RegistryKey contains "\\Control\\Class\\{4D36E96B-E325-11CE-BFC1-08002BE10318}\\UpperFilters" or RegistryKey contains "\\Control\\Class\\{4D36E96B-E325-11CE-BFC1-08002BE10318}\\LowerFilters")

Splunk · SPL

Run this as a search.

index=* (TargetObject="*\\Control\\Class\\{4D36E96B-E325-11CE-BFC1-08002BE10318}\\UpperFilters*" OR TargetObject="*\\Control\\Class\\{4D36E96B-E325-11CE-BFC1-08002BE10318}\\LowerFilters*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(registry.path) LIKE "*\\\\control\\\\class\\\\{4d36e96b-e325-11ce-bfc1-08002be10318}\\\\upperfilters*" OR TO_LOWER(registry.path) LIKE "*\\\\control\\\\class\\\\{4d36e96b-e325-11ce-bfc1-08002be10318}\\\\lowerfilters*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)(\\Control\\Class\\\{4D36E96B-E325-11CE-BFC1-08002BE10318\}\\UpperFilters|\\Control\\Class\\\{4D36E96B-E325-11CE-BFC1-08002BE10318\}\\LowerFilters)</field>    <description>Keyboard class filter driver registered under the class key</description>    <mitre>      <id>T1056.001</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: high
Category: process_injection
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: e0be112a-7e06-4413-98e3-6db79c45c84c

ATT&CKT1056.001

T1056.001Keylogging

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1056.001, evaluated against their registry_set events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add a process gate. Either put Image in a fields: list so the analyst
Exclude the VDI pool by hostname, not by process — the agents re-register
Pair, do not widen. Join this to System 7045 for the driver that appeared,
Accept the evasion. A user-mode keylogger — SetWindowsHookEx,

Declared by the author

OEM keyboard, hotkey and touchpad packages, which write the filter list while installing or updating their driver. This is the largest source of benign hits, and it clusters in imaging and driver-update windows rather than appearing continuously, so the change window is what separates it from adversary activity rather than anything in the event.
Virtualisation guest additions, VDI and remote-access agents, which install a keyboard filter so that input can be redirected into the session. These appear once per build on the affected fleet.
Security and accessibility products that legitimately own the keyboard stack — anti-keylogger and credential-guard style agents, kiosk lockdown software, on-screen keyboards, smartcard and biometric middleware. A keystroke-encrypting security agent is structurally the same registration as a keylogger.
Because Sysmon reports a multi-string value as binary data, a write that merely reorders or removes existing entries is indistinguishable from one that adds a driver, and the rule alerts on both. Pair this with the service-creation event for the named driver before treating a hit as confirmed.

Lessonprocess injection

process injectionAI draft — unreviewed

01 · What this rule detects

One Sysmon EventID 13 registry write, to one place. {4D36E96B-E325-11CE-BFC1-08002BE10318} is the device setup class GUID for keyboards. Under it, UpperFilters and LowerFilters are the ordered lists of drivers Windows loads above and below the keyboard class driver. A kernel-mode keylogger that wants keystrokes before any application sees them has to get its service name into one of those two values, and that write is the event. Be blunt about coverage, because the reviewer was. AN0243 describes "SetWindowsHookEx, GetKeyState, or polling functions within non-UI service processes, combined with Registry or driver modifications" — an API leg and a persistence leg, correlated. This rule is the persistence leg alone, and the variant it covers is the uncommon one. Agent Tesla and Snake Keylogger install a user-mode WH_KEYBOARD_LL hook and never touch the class key. Treat this as a high-confidence, low-coverage sentinel, not as coverage of T1056.001.

02 · Telemetry you need

Your Sysmon config must include this path. The widely used community
Sentinel refuses this logsource — validation.json records it. Splunk,

03 · How the logic works

One selection, one field, two alternatives:

TargetObject on registry_set carries key and value name concatenated, which is why the GUID and the value name can sit in one string. contains rather than an anchored match tolerates the HKLM\SYSTEM\CurrentControlSet versus ControlSet001 variation that Sysmon emits. What the event cannot tell you: which driver was added. Sysmon renders a REG_MULTI_SZ value as the literal string Binary Data in Details, so the new service name is not in the record. A write that reorders or removes an entry looks identical to one that inserts a keylogger. And there is no gate on the writing process — Image is available on EID 13 and is not in the selection — so every hit is a manual pivot to the System 7045 event for the named driver.

04 · Common false positives

The benign writers own this key legitimately, and there are more of them than you expect: OEM keyboard, hotkey and touchpad packages during install or driver update; VDI and remote-access agents that redirect input into a session; anti-keylogger, kiosk-lockdown, smartcard and biometric middleware — a keystroke-encrypting security agent is structurally the same registration as a keylogger.
The reviewer caught a miscount in the second false positive. It says these appear "once per build on the affected fleet." On a non-persistent VDI pool the Citrix VDA, VMware Horizon and Teradici agents re-register their filter on every desktop boot — once per session per desktop. On a 2,000-seat pool that is not a build-time burst, it is a continuous stream. The reviewer also flagged the fourth false positive as a detection limitation rather than a benign source; it belongs in the description.
level: high with no discriminating field means every OEM imaging window pages a human.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from DET0089, never executed against a log line. The registry path and the field are both genuinely correct, which is worth more than it sounds, but level: high is a judgement about a false-positive rate nobody has measured. To reach
tier_2: confirm your Sysmon config actually captures this key (write to it on a test host and look for the event), then run read-only across an imaging cycle and a VDI boot storm and rank hits by Image.
tier_3: means demoting this to a context signal and alerting on the pair — filter-list write plus a 7045 for an unsigned driver — which is a correlation engine's job, not Sigma's.

Related detections1 nearby

Network provider DLL registered in the registry

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/e0be112a-7e06-4413-98e3-6db79c45c84c

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Keyboard class filter driver registered under the class key

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it