What is Keylogger?
A keylogger is software or hardware that records keystrokes as a user types, capturing passwords, messages and anything else entered on the keyboard. Attackers use keyloggers to steal credentials, while some employers and parents run them openly for monitoring. MITRE ATT&CK tracks the attacker use as Input Capture: Keylogging (T1056.001).
Definition
- Keylogger
- A keylogger is software or hardware that records keystrokes as a user types, capturing passwords, messages and anything else entered on the keyboard. Attackers use keyloggers to steal credentials, while some employers and parents run them openly for monitoring. MITRE ATT&CK tracks the attacker use as Input Capture: Keylogging (T1056.001).
How Keylogger Works
On Windows, most software keyloggers rely on one of three mechanisms.
- The classic one is a low-level keyboard hook: a call to
SetWindowsHookExwith theWH_KEYBOARD_LLhook type asks Windows to pass every keyboard event to the malware's callback before the target application sees it. - A cruder variant polls
GetAsyncKeyStatein a tight loop and checks each virtual key for a press, which burns CPU but needs no hook at all. - The third route goes below user mode with a filter driver on the keyboard stack, harder to write and much harder to spot from inside the operating system.
MITRE's keylogging sub-technique lists the same families: hooking API callbacks, reading the hardware buffer, registry modifications and custom drivers.
Hardware keyloggers skip the operating system entirely. A small inline adapter between a USB keyboard and the PC, or a module hidden inside the keyboard, stores keystrokes on its own flash memory, and some models send them out over Wi-Fi. No endpoint agent sees them, so they turn up in physical inspections, not in alerts. Network devices are a separate case: MITRE notes that a modified system image on a router or switch can read raw keystrokes from administrator login sessions.
A keylogger on its own is only half an attack. The log has to leave the machine, so commodity stealers and remote access trojans bundle keylogging with an exfiltration channel:
- an SMTP send to a throwaway mailbox,
- an HTTP POST to a web panel,
- or a message to a chat bot API.
Many also grab the clipboard and take periodic screenshots, because passwords are often pasted from a password manager instead of typed. That bundling is why the keylogging module is rarely the thing an analyst detects first. The outbound channel or the persistence entry usually is.
Keylogger in SOC Operations
Keylogging shows up in a SOC through its side effects. EDR products that record API telemetry flag an unsigned process registering a low-level keyboard hook, especially one living in a user's AppData or Temp folder and launched from a Run key or scheduled task. On the network side, the giveaway is a workstation that suddenly speaks SMTP to the internet, or posts small, regular payloads to a newly registered domain or a messaging API. When an alert like that lands, scope it as a credential incident rather than a malware cleanup: every password typed on that host since the first sign of infection is presumed stolen, so the response includes resets, session revocation and a review of sign-in logs for those accounts. MITRE's note that keylogging is used when credential dumping fails is a useful triage hint too. A keylogger on a hardened host often means an earlier, failed dumping attempt is sitting in the logs.
Practice Keylogger in a Real SOC
SOCSimulator provides hands-on training with realistic SIEM, XDR, and Firewall interfaces. Build real analyst skills investigating keylogger scenarios with zero consequences, free.
Frequently Asked Questions
- Is it legal to use a keylogger?
- It depends on who owns the device and who has been told. Monitoring software on company-owned endpoints is common where the acceptable use policy discloses it, and parental control apps often include keystroke logging. Putting one on someone else's device without their knowledge is a different matter and can amount to unauthorized access or illegal interception. Rules vary by country and state, so that call belongs with legal counsel, not the SOC.
- What is the difference between spyware and keyloggers?
- Spyware is the broad category of software that collects information about a user without their knowledge. A keylogger is one collection method inside that category: it records keystrokes. Most information stealers ship a keylogging module next to browser credential theft, clipboard capture and screenshots, so in practice you usually meet a keylogger as one feature of a bigger tool.
- How do you know if someone is keylogging you?
- Software keyloggers rarely produce visible symptoms. The reliable signs are technical: an unfamiliar process that registers a keyboard hook, an autostart entry nobody created, or a host making regular outbound connections to a mail server or web panel it has no reason to talk to. For hardware loggers, check the cable between keyboard and computer for an adapter that should not be there.
- How to get rid of keyloggers?
- Isolate the host first, then remove the binary and its persistence (Run keys, scheduled tasks, services) with your EDR, or reimage, which is the safer option for a confirmed infection. The job is not done until every credential typed on that machine is reset from a clean device and active sessions are revoked, because the attacker already has the log.
Sources
Related Terms
Fileless malware is malicious code that runs in memory through tools the operating system already tr...
Data exfiltration in cyber security is the unauthorized transfer of data from an organization's syst...
Command and Control (C2) refers to the infrastructure and communication channels adversaries use to ...
MFA (multi-factor authentication) is a sign-in check that asks for two or more different kinds of pr...
EDR (endpoint detection and response) is security software that puts an agent on each laptop, server...
An insider threat is a security risk originating from current or former employees, contractors, or b...
More Threats Terms
Related SOC Training Resources
Threat Hunter Career Guide: Salary & Skills
Threat Hunters do not wait for alerts. You develop hypotheses based on threat intelligence and adversary behavior models…
Read more Career PathIncident Responder Career Guide: Salary & Skills
Incident Responders lead the technical response when confirmed breaches happen. You coordinate containment, run forensic…
Read more Career PathSOC Analyst (Tier 2) Career Guide: Salary & Skills
Tier 2 SOC Analysts handle the investigations that Tier 1 escalates. You dig into multi-stage attacks, coordinate contai…
Read more ComparisonSOCSimulator vs Hack The Box: Comparison
Different tools for different career paths. SOCSimulator trains defensive analysts. Hack The Box trains offensive securi…
Read more ToolXDR Training Console: SOCSimulator
The XDR console in SOCSimulator replicates the investigation workflow of platforms like CrowdStrike Falcon, Microsoft De…
Read more ToolSIEM Training Console: SOCSimulator
The SIEM console in SOCSimulator replicates the workflow of enterprise platforms like Splunk Enterprise Security, Micros…
Read more TechniqueMITRE ATT&CK® Techniques: Detection Training Library
Browse all MITRE ATT&CK® techniques with detection strategies and example alerts.
Read more Career PathCybersecurity Career Paths: 2026 Guide
Explore SOC analyst career paths with salary data, required skills, and certification roadmaps.
Read more PlaybookSOC Investigation Playbooks: Step-by-Step Guides
Practitioner investigation playbooks with decision trees and real SIEM queries.
Read more FeatureShift Mode: Real-Time SOC Simulation
Practice alert triage under realistic time pressure with SLA timers and noise injection.
Read more FeatureOperations: Guided Training Operations
Structured CTF-style investigation operations covering real-world attack scenarios.
Read more BlogSOCSimulator Blog: Security Training Insights
Articles on SOC analyst skills, detection engineering, and career development.
Read more