Disclaimer: This tool was built strictly for educational purposes in an isolated virtual machine environment. It should NEVER be deployed on systems you do not own or have explicit written authorization to test. Unauthorized use is illegal under the IT Act, 2000 (India) and equivalent laws globally.
Understanding how keyloggers work is essential for a SOC analyst or VAPT professional. This project helped me understand how attackers capture credentials silently, which directly informs detection strategies.
- Captures keystrokes within a defined test window
- Timestamps each keystroke
- Saves output to a local log file
- Persistence mechanisms: Registry run keys, scheduled tasks
- Detection: Endpoint EDR tools flag pynput/keyboard library behavior
- Mitigation: Application allowlisting, keyboard encryption (Secure Input on macOS)
Tested exclusively on an isolated Windows VM with no network access. Never tested on live systems.
This tool would be flagged by:
- Windows Defender (heuristic behavioral detection)
- Any EDR with process injection monitoring