# keylog_start - Start Keylogger

Start a low-level keyboard logger that captures all keystrokes from the system.

## Description

The `keylog_start` command starts a low-level keyboard logger that captures all keystrokes from the system and streams them to Mythic in real-time. Uses Windows keyboard hooking mechanisms (SetWindowsHookEx) to intercept keyboard input at a low level. CRITICAL OPSEC RISK: Keyloggers are extremely detectable by EDR/XDR solutions.

## Syntax

```
keylog_start
```

## Examples

```
keylog_start
```

## Features

- Captures all keystrokes from the system and streams them to Mythic in real-time
- Uses Windows keyboard hooking mechanisms (SetWindowsHookEx) to intercept keyboard input at a low level
- CRITICAL OPSEC RISK: Keyloggers are extremely detectable by EDR/XDR solutions, anti-malware, and behavioral analysis engines
- Detection is likely within minutes or hours
- Always requires approval from a lead operator
- Consider alternatives such as credential theft, browser credential extraction, or clipboard monitoring for better OPSEC

## Output

```
[keylog_start] Starting keylogger...
[keylog_start] Keyboard hook installed
[keylog_start] Keylogger active
```

## OPSEC Considerations

- **CRITICAL OPSEC RISK**: Extremely detectable
- Detection is likely within minutes or hours
- Always requires operator approval (OPSEC pre-check blocks execution)
- Consider alternatives for better OPSEC

## Related

[OPSEC Checking](../../../opsec.md), [Keylogging Support](../../../features.md#keylogging-support)

---

**Command Category:** System Operations  
**Requires Admin:** No  
**MITRE ATT&CK:** [T1056 - Input Capture](https://attack.mitre.org/techniques/T1056/)