Process opens a raw Linux input device under /dev/input

Siemphony@siemphonylowT1056unverified

AN0283 is the one leg of this technique with an observable T1056.001 doesn't already cover: instead of the Windows registry keyboard filter driver, this is a Linux userspace process reading raw keystroke and pointer events off `/dev/input/*` (evdev), with no driver-installation step at all. The match is on the auditd PATH record's own `name` field, because auditd emits PATH and SYSCALL as separate records for the same event and the accessing process's `exe`/`comm` live only on the SYSCALL side, so they cannot be joined into this selection — a real limitation, not a choice. AN0282's Windows leg (SetWindowsHookEx, GetAsyncKeyState) is not attempted: those are message-hook and global-state calls that never open a handle to another process, so Sysmon Process Access — the log source the brief lists for it — has no field that could ever carry that behaviour. Prerequisite: this needs an explicit auditd watch on `/dev/input/`, absent from a default configuration on any mainstream distribution. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0102, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* (type="PATH" AND name="/dev/input/*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(type) == "path" AND TO_LOWER(name) LIKE "/dev/input/*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="type" type="pcre2">(?i)^PATH$</field>    <field name="name" type="pcre2">(?i)^/dev/input/</field>    <description>Process opens a raw Linux input device under /dev/input</description>    <mitre>      <id>T1056</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"product":"linux","service":"auditd"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: auditd / linux
Level: low
Category: process_injection
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: f602ff4f-f5ff-4790-9206-5f3a2082fc69

ATT&CKT1056

T1056Input Capture

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonprocess injection

process injectionAI draft — unreviewed

01 · What this rule detects

This rule catches a process opening a raw Linux input device node under /dev/input/ — the evdev interface the kernel uses to deliver keyboard and pointer events. It implements AN0283, the Linux leg of Input Capture (T1056). It is deliberately narrow: the sibling technique T1056.001 already covers the Windows keyboard class-filter driver (a registry key under UpperFilters/LowerFilters), a different platform, mechanism and logsource entirely, so there's no overlap to worry about here.

02 · Telemetry you need

logsource: product: linux, service: auditd. This only works if the host has an explicit auditd watch rule on `/dev/input/` — auditd does not audit arbitrary file opens by default on any mainstream distribution. Without that watch rule, this selection produces zero events no matter what an attacker does. Zero rows here does not mean "no keylogger" — it means "nobody turned the telemetry on," which is the most dangerous way a rule can go quiet.

03 · How the logic works

The whole detection is one selection:

auditd emits a PATH record for every path a syscall touches, separately from the SYSCALL record that carries the process identity (exe, comm). This rule matches only on the PATH record's name field — it never tries to add who did the opening, because Sigma has no way to join those two records back together into one selection. That's also why there's no time window or "N opens in M seconds" aggregation logic: lib/sigma in this corpus doesn't model timeframes or | count() by, so every rule here is precursor-only — a single-event trigger, not the multi-signal aggregation a mature SIEM rule would eventually become. That's normal for this corpus, not a shortcut taken for this rule specifically.

04 · Common false positives

The first false positive is the one that sets the rule's ceiling: Xorg, Wayland compositors, systemd-logind and libinput all open every /dev/input/event* node as their normal job of routing input to the desktop session, and on any GUI host that's the overwhelming majority of matches by a wide margin. evtest, accessibility input handlers, and game-controller daemons (jstest, SDL-based tools) round out the list — all legitimate, all match. level: low is set to match that first entry honestly, rather than claiming a severity the noisiest false positive doesn't support.

05 · Detection maturity

tier_1: UNVERIFIED — the lowest tier in this corpus. This rule was authored from the MITRE scaffold and has never been executed against a single log line, so there is no false-positive rate, hit count, or tuning outcome to report from it. Any such number here would be invented.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's AN0283 names two knobs: ProcessName and DevicePath. This rule implements DevicePath — the author populated it with /dev/input/ and a startswith modifier, a value and modifier choice made here, not by MITRE. ProcessName is not implemented at all, and that's a real limitation, not an oversight: it would require joining back to the SYSCALL record this rule structurally cannot reach. The review caught a second gap worth internalizing as a general pattern: startswith only anchors on the literal string auditd logged. A process that reaches the same physical device through a relative path, a symlink outside /dev/input/, or a bind mount would read the same keystrokes and never match. Tightening the string match doesn't fix that class of evasion — it needs a device-identity field this rule doesn't have.

Declared by the author

Xorg, Wayland compositors, systemd-logind and libinput, which open every /dev/input/event* node as their core function of delivering keyboard and pointer input to the desktop session — on any host running a GUI this is the overwhelming majority of matches and dominates the rule by a wide margin.
evtest, libinput debug-events and similar diagnostic tools an administrator runs interactively to test a keyboard, touchpad or gamepad after a driver or hardware change.
Accessibility software — on-screen keyboards, switch-access and screen-reader input handlers — that reads raw input events to implement an alternate input method.
Game controller and joystick daemons (jstest, SDL-based games and emulators) polling /dev/input/event or /dev/input/js for gamepad input during normal use.

Noise check0 of 5 fired

Fires on none of the 5 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 5 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1056, evaluated against their — events.

Share this rule

/u/siemphony/f602ff4f-f5ff-4790-9206-5f3a2082fc69

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Process opens a raw Linux input device under /dev/input

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it