{"version":"1.0","type":"rich","provider_name":"RootPwn","provider_url":"https://rootpwn.me","title":"Detecting Hotkey‑Based Keyloggers via Undocumented Kernel Hotkey Table","description":"Elastic Security Labs uncovered a new Windows keylogger technique that hijacks the RegisterHotKey API to capture keystrokes. The detection method uses the undocumented kernel hotkey table and ETW events from the Win32k provider, and is available in Elastic Defend 8.12.","url":"https://rootpwn.me/news/detecting-hotkey-based-keyloggers-via-undocumented-kernel-hotkey-table","thumbnail_url":"https://rootpwn.me/images/e663eb51e2df410a8b1517f7a34414c5.jpg","thumbnail_width":1600,"thumbnail_height":900}