Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
Sigma Rule to Detect Uncommon Keyboard Layout Loads in Your Organisation
title: Suspicious Keyboard Layout Load
description: Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only
author: Florian Roth
date: 2019/10/12
product: windows
service: sysmon
definition: 'Requirements: Sysmon config that monitors \Keyboard Layout\Preload subkey of the HKLU hives - see'
EventID: 13
TargetObject: '*\Keyboard Layout\Preload\*'
- 00000804 # Chinese
- 00000c04 # Chinese
- 00000404 # Chinese
- 00001004 # Chinese
- 00001404 # Chinese
- 00000429 # Persian (Iran)
- 00050429 # Persian (Iran)
- 0000042a # Vietnamese
- 00000401 # Arabic
- 00010401 # Arabic
- 00020401 # Arabic
condition: selection_registry
- "Administrators or users that actually use the selected keyboard layouts (heavily depends on the organisation's user base)"
level: medium
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.