Verify the setup
How to see Keystrike at work without being under attack?
Using an On-Screen Keyboard
After deploying and running Keystrike terminator on a remote host (terminator machine) and the client on the workstation.
The user on the workstation:
- Opens a remote desktop to the Terminator machine.
- Starts Windows “On-Screen Keyboard” on the workstation.
- Types into any application on the remote machine with the On-Screen keyboard instead of the physical one.
This will trigger alerts as the keystrokes are not attested, only keystrokes from the physical keyboard on the workstation are attested.
Enter Keystrike Terminator enabled host without a Client
After deploying and running Keystrike terminator on a remote host.
From a machine with no Keystrike Client:
- Open a remote desktop to the Terminator machine.
- Type into any application on the remote machine.
- Alerts are generated.
- If the terminator is in Enforcement mode, the keystrokes and mouse clicks are blocked.
Take over a Keystrike Client enabled machine with Zoom
After deploying and running Keystrike terminator on a remote host (Terminator machine) and the client on the workstation.
The user on the workstation (calling it user A):
- Opens a remote desktop to the Terminator machine.
- Types into any application on the remote machine.
- No alerts are generated, this is allowed behavior.
User A starts a Zoom meeting with another user (user B) that takes remote control of his workstation.
While screen sharing, click Remote Control and select the participant you want to give control to. The participant will be notified they can control your screen and can click anywhere on the shared screen to start control.
Now user B can remotely control user A’s workstation, much like a remote attacker.
User B enters the remote desktop at the Terminator machine and starts typing into an open application.
- Alerts are generated.
- If the terminator is in Enforcement mode (not in Audit mode), user B’s input is blocked.
Where to find alerts
Triggered alerts can be found in the Keystrike admin panel and may have been sent to different target systems (e.g. SIEM, Slack) via Web hook, depending on your configuration.