MALW_CAP_HookExKeylogger.yar

/*
    This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as    long as you use it under this license.

*/

rule CAP_HookExKeylogger
{

meta:
    author = "Brian C. Bell -- @biebsmalwareguy"
    reference = "https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar"

    strings:
    $str_Win32hookapi = "SetWindowsHookEx" nocase
    $str_Win32llkey = "WH_KEYBOARD_LL" nocase
    $str_Win32key = "WH_KEYBOARD" nocase

    condition:
        2 of them
}