Keylogging
Named by 4 kept items in this workspace.
Search every workspace for Keylogging. It matches the name as written, so it can find other things that share it.
The items that name it 4
Logs Windows keyboard events when enabled by the operator via a server-side status switch; artifacts noted at %TEMP%\kb-monitor\keyboard-monitor-*.ps1
AsyncRAT plugin that records keyboard strokes on the infected machine.
All techniques in this workspace.