lacy keylogger

Hunt Hypothesis

This detection targets adversaries deploying the Lacy keylogger to capture sensitive user inputs and credentials on endpoints within the Azure environment. Proactively hunting for this low-severity indicator is critical because early identification of keylogging activity can prevent credential theft before attackers escalate privileges or exfiltrate data.

YARA Rule

rule lacy_keylogger
{
meta:
	author = "@patrickrolsen"
	reference = "Appears to be a form of keylogger."
strings:
	$s1 = "Lacy.exe" wide
	$s2 = "Bldg Chive Duel Rip Query" wide
condition:
	uint16(0) == 0x5A4D and all of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

References

• Appears to be a form of keylogger.
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Lacy Keylogger detection rule in an enterprise environment, including suggested filters and exclusions:

• Endpoint Detection & Response (EDR) Telemetry Agents

  • Scenario: EDR solutions like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint often run background processes that hook into kernel APIs to monitor user input and application behavior. The YARA rule may flag the falcon.sys or mssec.exe modules as they inject hooks similar to keylogging mechanisms.
  • Filter/Exclusion: Exclude file paths containing known EDR vendor directories (e.g., C:\Program Files\CrowdStrike\, C:\Windows\System32\Microsoft Defender\) and filter out processes with specific digital signatures from the respective vendors.

• IT Asset Management & Software Inventory Scans

  • Scenario: Scheduled jobs running tools like SolarWinds RMM, Ivanti Endpoint Manager, or LanDesk periodically scan active user sessions to inventory installed software and usage patterns. These agents often utilize input monitoring hooks during the scan window, triggering the keylogger signature.
  • Filter/Exclusion: Create a time-based exclusion for these specific service accounts (e.g., svc_solarwinds) running between 02:00 and 04:00 UTC on weekdays, or exclude file paths under C:\Program Files\Ivanti\ where the process is identified as a scheduled task.

• Remote Support & Desktop Sharing Sessions

  • Scenario: When IT support initiates a remote session using tools like TeamViewer, AnyDesk, or Splashtop, these applications must capture keystrokes and mouse movements to relay them to the operator. The initialization of their input drivers (`tv