Custom Keylogger (Lab Env)

A PowerShell-based toolkit for automated loading, persistence, and keyboard-event analysis.

This project was developed in PowerShell to examine different stages of the attack lifecycle on Windows systems in a laboratory environment. It includes research scenarios involving a multi-stage loader (Stage-1), persistence, keylogging, and network-based data transfer.

Core Features

• Multi-Stage Execution: The Stage-1 script downloads the required components and automatically launches the second stage.
• Persistence Mechanism: Creates a Windows Registry entry that executes automatically when the user signs in.
• PowerShell Keylogger: Monitors keyboard input at user level and collects it in memory at defined intervals.
• Active Window Tracking: Records the titles of windows in which the user is working.
• Data Transfer: Can send data to the lab environment through HTTP requests or the Telegram Bot API.
• Background Execution: Runs PowerShell processes in hidden mode to minimize user interaction.
• Modular Design: Each component can run independently or as part of a chain.

Installation

Requirements

• Windows operating system
• PowerShell 5.1 or later
• Internet connection (optional)
• Telegram Bot API or an HTTP server, depending on the scenario

Clone the Project

git clone https://github.com/muzoovy/keylogger.git
cd keylogger

Usage

To run the Stage-1 loader:

powershell -ExecutionPolicy Bypass -File setup.ps1

To run the research scripts directly:

powershell -ExecutionPolicy Bypass -File keylogger.ps1

or

powershell -ExecutionPolicy Bypass -File keylogcu.ps1

📂 Project Structure

PowerShell-Research/
├── setup.ps1          # Stage-1 Loader
├── keylogger.ps1      # HTTP tabanlı araştırma modülü
├── keylogcu.ps1       # Telegram tabanlı araştırma modülü
└── README.md

Purpose

This project was developed to examine the following topics in a laboratory environment:

• Windows Persistence
• PowerShell Automation
• Keylogging Mechanisms
• Process Execution
• HTTP / Telegram Communication
• Detection Engineering
• Malware Analysis
• Threat Hunting