keylogger-architecture

Low-level keylogger architecture design: kernel driver hooks (WH_KEYBOARD_LL, SetWindowsHookEx), ETW-based input capture, user-mode vs kernel-mode approaches, stealth techniques, and data exfiltration. Use for understanding input capture mechanisms, EDR evasion research, or malware architecture analysis. Trigger phrases: keylogger, keyboard hook, WH_KEYBOAR…

Independent GitHub snapshot · Automated classification · Original documentation governs