marcos.luna
54 lines
1.7 KiB
Markdown
54 lines
1.7 KiB
Markdown
# keylog_start - Start Keylogger
|
|
|
|
Start a low-level keyboard logger that captures all keystrokes from the system.
|
|
|
|
## Description
|
|
|
|
The `keylog_start` command starts a low-level keyboard logger that captures all keystrokes from the system and streams them to Mythic in real-time. Uses Windows keyboard hooking mechanisms (SetWindowsHookEx) to intercept keyboard input at a low level. CRITICAL OPSEC RISK: Keyloggers are extremely detectable by EDR/XDR solutions.
|
|
|
|
## Syntax
|
|
|
|
```
|
|
keylog_start
|
|
```
|
|
|
|
## Examples
|
|
|
|
```
|
|
keylog_start
|
|
```
|
|
|
|
## Features
|
|
|
|
- Captures all keystrokes from the system and streams them to Mythic in real-time
|
|
- Uses Windows keyboard hooking mechanisms (SetWindowsHookEx) to intercept keyboard input at a low level
|
|
- CRITICAL OPSEC RISK: Keyloggers are extremely detectable by EDR/XDR solutions, anti-malware, and behavioral analysis engines
|
|
- Detection is likely within minutes or hours
|
|
- Always requires approval from a lead operator
|
|
- Consider alternatives such as credential theft, browser credential extraction, or clipboard monitoring for better OPSEC
|
|
|
|
## Output
|
|
|
|
```
|
|
[keylog_start] Starting keylogger...
|
|
[keylog_start] Keyboard hook installed
|
|
[keylog_start] Keylogger active
|
|
```
|
|
|
|
## OPSEC Considerations
|
|
|
|
- **CRITICAL OPSEC RISK**: Extremely detectable
|
|
- Detection is likely within minutes or hours
|
|
- Always requires operator approval (OPSEC pre-check blocks execution)
|
|
- Consider alternatives for better OPSEC
|
|
|
|
## Related
|
|
|
|
[OPSEC Checking](../../../opsec.md), [Keylogging Support](../../../features.md#keylogging-support)
|
|
|
|
---
|
|
|
|
**Command Category:** System Operations
|
|
**Requires Admin:** No
|
|
**MITRE ATT&CK:** [T1056 - Input Capture](https://attack.mitre.org/techniques/T1056/)
|