Lion Cipher Lab
Characterize a keylogger: hooks, captured-keystroke logs, and exfiltration
- Digital Forensics & IR (DFIR)
- Intermediate
- ~50 min
- Free · no account required
Why it matters
A keylogger is one of the oldest and most durable ways an attacker beats every password you have: it doesn't need to crack anything, it just watches you type it. It sits quietly in your session, records the keys you press along with the window you pressed them in, and ships that log to its operator on a timer — so it captures the passwords you type into sites that store nothing locally, the codes you paste from an authenticator, the message you thought was private. When one turns up on an endpoint, your boss doesn't ask for the file hash; they ask 'what did it see me type, and whose passwords…
What you'll learn
- reading a behavioral sandbox trace (API calls, file writes, network) to characterize a keylogger
- recognizing the keyboard-capture fingerprint: a WH_KEYBOARD_LL low-level hook via SetWindowsHookEx (vs GetAsyncKeyState polling or raw-input registration)
- reading a captured-keystroke log file — window titles plus typed text — as the smoking-gun artifact
- spotting clipboard theft via OpenClipboard/GetClipboardData in the same trace
- identifying the exfil channel when a keylogger mails its log out over SMTP to a drop mailbox
- extracting IOCs (hook DLL, log path, mail drop, SMTP server, X-Mailer) and mapping to MITRE ATT&CK (T1056.001, T1115, T1041)
- scoping impact from the log alone: which typed credentials to force-reset, in what order
- judgment: when the hook + log characterize the keylogger and when you must reverse the binary
Steps in this lab
- The scene: you're the analyst, and this is all you have
- Artifact 1 — the API monitor: HOW it captures every keystroke
- Artifact 2 — the captured-keystroke log: the smoking gun
- Artifact 3 — clipboard theft: it grabs what you paste, not just what you type
- Artifact 4 — the network capture: HOW the log leaves the building
- Pull the IOCs and map the behavior to MITRE ATT&CK
- The judgment call: when the log is enough, why this IS the pattern, and how a pro scopes the damage
- What you can now do (and how to practice it safely)