Keylogger Architecture Research Notes
Explains low-level Windows keylogger designs, their detection signatures (IOCs), and stealth tradeoffs for security research.
- Repository
- SnailSploit/Claude-Red
- Stars
- 10,230
- Licence
- MIT
- Files
- 1 file
What it does
This skill loads a written methodology about how Windows keyboard-capture software works, including hook types (such as SetWindowsHookEx and WH_KEYBOARD_LL), raw-input registration, ETW-based capture, user-mode versus kernel-mode designs, stealth, and data exfiltration. Once installed, the agent walks through these techniques as a checklist, notes what each one would leave behind as detectable indicators, and suggests next steps. It is a reference and analysis aid; the SKILL.md itself contains no executable code.
Great for
- Security researchers studying how keyloggers are built and detected
- Malware analysts who want detection indicators for keyboard hook techniques
- Students learning Windows input architecture and endpoint detection concepts
Skip it if
- Anyone wanting working keylogger code or step-by-step deployment: the skill describes attack techniques and evasion, which can enable harm to others' devices and privacy
- Monitoring another person's keyboard without consent, which is illegal in most places and is not supported by the defensive framing
- Beginners expecting a tutorial: the content is terse notes with unfinished questions, so output quality depends heavily on the agent's own knowledge
Try asking
- “Explain how WH_KEYBOARD_LL differs from a regular global hook in terms of injection and detection footprint”
- “List the IOCs an EDR could use to spot a SetWindowsHookEx-based input hook”
- “Review the raw-input registration technique and what telemetry would reveal it”
- “Turn this methodology into a defensive detection checklist for my SOC”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the MIT licence and an attribution note.
offensive-keylogger-arch.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip offensive-keylogger-arch.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip offensive-keylogger-arch.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Frame requests defensively (detection, IOCs, malware analysis) rather than asking for working code, which the skill does not provide and the agent should decline to produce.
- Check the source repository's license and context before relying on the notes, since the file is a rough, partially unfinished write-up.
- Treat the agent's answers as research leads and verify technical claims against Microsoft documentation.
What's inside
- SKILL.md
Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.