Keylogger Arch

This covers the architecture of Windows keyloggers from userland hooks to kernel drivers, walking through six methods with actual code and their detection profiles. You get SetWindowsHookEx mechanics (both low-level and regular), RegisterRawInputDevices, GetAsyncKeyState polling, direct HID access, and ETW-based capture. The real value is in the IOC analysis for each approach, especially the RegisterRawInputDevices ETW telemetry that most red teamers miss. It includes window title capture for context filtering and practical stealth techniques like DNS exfiltration and sleep masking. Use this when designing implant persistence modules or analyzing malware samples to understand their capture mechanism and detection surface. The comparison table at the end is genuinely useful for threat modeling.

GitHub stars: 280
last updated: May 28, 2026

View on GitHub

Install

$ npx -y skills add hypnguyen1209/offensive-claude --skill keylogger-arch --agent claude-code

Installs into .claude/skills of the current project.

Files

name: keylogger-architecture description: Use when designing or analyzing keystroke/input capture — SetWindowsHookEx, raw input devices, ETW-based capture, kernel drivers, stealth techniques and their IOCs metadata: type: offensive phase: research kill_chain: phase: [install, actions] step: [5, 7] attck_tactics: [TA0003, TA0009] depends_on: [privesc-windows, edr-evasion] feeds_into: [red-team-ops] inputs: [target_os, edr_product] outputs: [keylogger_binary, captured_input]

Keylogger Architecture

When to Activate

Understanding input capture mechanisms for red team implants
Analyzing malware keylogging capabilities
EDR evasion research for input monitoring
Designing stealthy credential capture

Method 1: SetWindowsHookEx (WH_KEYBOARD_LL)

How It Works

// Install global low-level keyboard hook
HHOOK hHook = SetWindowsHookEx(WH_KEYBOARD_LL, LowLevelKeyboardProc, hInstance, 0);

SKILL.md on GitHub

Details

Repository: github.com/hypnguyen1209/offensive-claude
Categories: Security, Mobile Development
License: MIT
First seen: Jun 11, 2026