Create log-keystrokes-via-input-method-manager.yml (#834)

mandiant · Oct 9, 2023 · 0b6aeb7 · 0b6aeb7
1 parent 8e2e86b
commit 0b6aeb7
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/nursery/log-keystrokes-via-input-method-manager.yml b/nursery/log-keystrokes-via-input-method-manager.yml
@@ -0,0 +1,16 @@
+# generated using capa explorer for IDA Pro
+rule:
+  meta:
+    name: log keystrokes via Input Method Manager
+    namespace: collection/keylog
+    authors:
+      - "@mr-tz"
+    scope: function
+  features:
+    - and:
+      - or:
+        - api: ImmGetCompositionString
+        - api: ImmGetVirtualKey
+      - optional:
+        - api: ImmGetContext
+        - api: ImmReleaseContext