About This Tool

Primary Use Case

Key Features

• Logs all common character and function keys with Shift and AltGr awareness
• Runs as a daemon for continuous background keylogging
• Setuid root helper programs for quick and covert start/stop
• Uses Linux input subsystem event interface for accurate key capture
• Supports manual device specification for input event devices
• UTF-8 locale support for proper character encoding
• Default log file stored securely at /var/log/logkeys.log

Insights & Recommendations

Running logkeys requires root privileges or setuid root helper programs to access input devices. Proper locale settings (UTF-8) are critical for accurate character logging, especially with Shift and AltGr keys. Users should verify the correct input event device to avoid empty logs or errors. Use responsibly and ethically, as keyloggers can capture sensitive information.

Installation

Refer to the INSTALL file for detailed installation and build notes
Build the software according to instructions in INSTALL
Ensure you have root privileges to install setuid root helper programs
Test the program manually by creating a test log file
Run logkeys with appropriate device and locale settings

Usage

Smart Usage Notes

• Can be chained with post-exploitation frameworks to capture credentials stealthily.
• Useful for red team exercises simulating insider threat or credential theft scenarios.
• Blue teams can deploy modified versions to detect unauthorized keylogging activity by monitoring logkeys processes and logs.
• Integrate with Security Information and Event Management (SIEM) for automated alerting on suspicious input capture.
• Use in purple team exercises to validate detection capabilities and improve endpoint monitoring strategies.

Security Capability Profile