offensive-keylogger-arch

1# SKILL: Novel research
2 
3## Metadata
4- **Skill Name**: keylogger-architecture
5- **Folder**: offensive-keylogger-arch
6- **Source**: https://github.com/SnailSploit/offensive-checklist/blob/main/Low-level%20Keylogger%20architecture_.md
7 
8## Description
9Low-level keylogger architecture design: kernel driver hooks (WH_KEYBOARD_LL, SetWindowsHookEx), ETW-based input capture, user-mode vs kernel-mode approaches, stealth techniques, and data exfiltration. Use for understanding input capture mechanisms, EDR evasion research, or malware architecture analysis.
10 
11## Trigger Phrases
12Use this skill when the conversation involves any of:
13`keylogger, keyboard hook, WH_KEYBOARD_LL, SetWindowsHookEx, ETW, kernel driver, input capture, low-level keylogger, malware architecture, stealth, exfiltration`
14 
15## Instructions for Claude
16 
17When this skill is active:
181. Load and apply the full methodology below as your operational checklist
192. Follow steps in order unless the user specifies otherwise
203. For each technique, consider applicability to the current target/context
214. Track which checklist items have been completed
225. Suggest next steps based on findings
23 
24---
25 
26## Full Methodology
27 
28 
29 
30Case study of different keylogger implementations, how to implement them and their individual IOCs.
31 
32---
33## SetWindowHookEx
34Majority of malware uses user32.dll!SetWindowHookEx to create a global hook event. this modifies an internal structure in `win32k.sys`.
35…