SendKeys PowerShell Injection

A defense-evasion technique where a Visual Basic or JScript dropper launches powershell.exe in a visible window, then uses WshShell.SendKeys to inject keystrokes into the PowerShell console as if a user were typing. The keystrokes contain a malicious command read from a registry value. After the command is sent, SendKeys "{ENTER}" executes it, followed by a cleanup command (e.g., killing conhost) to close the window.

What It Is

This is a low-tech, high-stealth execution path:

1. Launch powershell.exe with window style 2 (hidden/minimized) or 1 (normal).
2. Use WMI to enumerate processes and find the powershell.exe PID.
3. Call WshShell.AppActivate(pid) to focus the window.
4. Call WshShell.SendKeys(...) to type the payload command.
5. Send {ENTER} to execute.
6. Optionally send a second command to terminate the console.

Because the input appears to come from the keyboard (via the Windows message queue), some EDRs that hook CreateProcess or monitor parent-child relationships may not flag the PowerShell command as suspicious.

Detection / Fingerprint

• Process creation: wscript.exe → powershell.exe with no command-line arguments (the shell is spawned empty).
• Shortly after spawn, the PowerShell process receives rapid keystrokes via SendKeys.
• The PowerShell command line in EDR telemetry is empty or minimal; the actual commands never appear on the process creation event.
• Look for AppActivate + SendKeys sequences in VBS/JS scripts.

Pages Where Observed

• unclassified-js-horus-dropper — VBS stage that injects a registry-staged PowerShell reflective loader via SendKeys into a hidden PowerShell window

References

• MITRE ATT&CK T1056.002 (GUI Input Capture): https://attack.mitre.org/techniques/T1056/002/
• MITRE ATT&CK T1059.001 (PowerShell): https://attack.mitre.org/techniques/T1059/001/