情報窃取から端末を守る

This report describes Elastic Defend 8.12's new behavior-based detection capabilities for Windows keyloggers: it explains four common keylogging techniques (polling via GetAsyncKeyState, hooks via SetWindowsHookEx, Raw Input via RegisterRawInputDevices, and DirectInput), how ETW is used to monitor relevant API calls and parameters, example detection rules/queries (including a RegisterRawInputDevices detection query), and the API metadata fields Elastic collects to reduce false positives and improve keystroke-capture detection.