← Back to SOC feed Coverage →

Dirty user level command line keylogger hacked together in Swift.

yara LOW signature-base
florian-rothinfostealer
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at signature-base →
Retrieved: 2026-05-28T11:00:00Z · Confidence: medium

Hunt Hypothesis

A user-level Swift-based command line keylogger may be used to stealthily capture sensitive input, indicating potential persistence or data exfiltration. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate low-severity, yet potentially persistent adversaries leveraging custom tools.

YARA Rule

rule hacktool_macos_keylogger_b4rsby_swiftlog
{
    meta:
        description = "Dirty user level command line keylogger hacked together in Swift."
        reference = "https://github.com/b4rsby/SwiftLog"
        author = "@mimeframe"
        id = "7f42e787-a723-5e20-99a3-54e1ffa6ccda"
    strings:
        $a1 = "You need to enable the keylogger in the System Prefrences" wide ascii
    condition:
        all of ($a*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Neo23x0/signature-base/blob/main/vendor/yara/airbnb_binaryalert.yar