keylogger-arch

设计与分析键盘/输入捕获架构及隐蔽实现技术概览。

用于把输入捕获相关的技术和检测点讲清楚，帮你看懂攻击面和可用的检测指标。常见于安全评估、红队或编写防护/检测逻辑时参考，会提到系统钩子、原始输入、ETW、内核模块等名词但不提供可复用的攻击步骤。重点是合规授权下的分析与防御建议，并列出可用于检测的 IOC 而非实现细节。

---
name: keylogger-architecture
description: Use when designing or analyzing keystroke/input capture — SetWindowsHookEx, raw input devices, ETW-based capture, kernel drivers, stealth techniques and their IOCs
metadata:
  type: offensive
  phase: research
kill_chain:
  phase: [install, actions]
  step: [5, 7]
  attck_tactics: [TA0003, TA0009]
depends_on: [privesc-windows, edr-evasion]
feeds_into: [red-team-ops]
inputs: [target_os, edr_product]
outputs: [keylogger_binary, captured_input]
  ---

# Keylogger Architecture

## When to Activate

- Understanding input capture mechanisms for red team implants
- Analyzing malware keylogging capabilities
- EDR evasion research for input monitoring
- D