lintai docs

Appearance

Rule Reference

SEC728lintai-ai-securitystablehookdeny

Hook script: keylogger exfiltration

Hook script captures and exfiltrates keystrokes or keyboard input

Provider
lintai-ai-security
Surface
hook
Scope
per_file
Tier
stable
Severity
deny
Confidence
high
Detection
structural
Remediation
message_only

Activation Model

Preset Membership

This rule is part of the builtin activation graph through these preset memberships.

basemembership

Lifecycle

Stable Lifecycle Contract

State

stable_gated

Graduation rationale

Checks hook shell lines for explicit keystroke capture utilities or keylogger markers combined with remote transfer behavior.

Deterministic signal basis

HookSignals command-line analysis over non-comment hook lines for explicit keylogger primitives such as `logkeys`, `xinput test`, `evtest`, `showkey`, PowerShell `GetAsyncKeyState`, or inline Python listener markers like `pynput.keyboard.Listener`, combined with remote sinks such as `curl`, `wget`, `scp`, `rsync`, `nc`, or HTTP(S) endpoints.

Malicious corpus
hook-keylogger-exfil
Benign corpus
cursor-plugin-clean-basic
structured evidence required remediation reviewed
Canonical note

Structural stable rule intended as a high-precision check with deterministic evidence.

Nearby Signals

Related Rules

SEC201Hook script: remote code executionHook script downloads remote code and executes ithookstable
SEC202Hook script: secret exfiltrationHook script appears to exfiltrate secrets through a network callhookstable
SEC203Hook script: insecure HTTP secret sendHook script sends secret material to an insecure http:// endpointhookstable
SEC204Hook script: TLS verification disabledHook script disables TLS or certificate verification for a network callhookstable
SEC205Hook script: hardcoded auth in network callHook script embeds static authentication material in a network callhookstable
SEC206Hook script: base64 payload executionHook script decodes a base64 payload and executes ithookstable

Why It Matters ​

Capturing keyboard input and sending it to a remote destination is high-confidence surveillance and credential theft behavior.

What Triggers ​

SEC728 matches executable hook lines that invoke explicit keylogger primitives such as logkeys, xinput test, evtest, showkey, PowerShell GetAsyncKeyState, or inline Python listener markers like pynput.keyboard.Listener, and also transmit data to remote sinks such as curl, wget, scp, rsync, nc, or HTTP(S) endpoints.

False Positives ​

Shared committed hooks should not capture and transmit keyboard input. Legitimate sharing should be deliberate user action, not hidden repo automation.

Remediation ​

Remove keystroke capture and remote transfer behavior from the shared hook and keep keyboard data local unless the user explicitly chooses to share it.