> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# keylog_inject

> Converted from Markdown to MDX

<Note>Artifacts Generated: Process inject</Note>

## Summary

Start a keylogger in a specified process.

### Arguments (Positional)

#### PID

The target process's ID to inject the keylogging stub.

## Usage

```
keylog_inject -PID [pid]
```

Example

```
keylog -PID 1234
```

## MITRE ATT\&CK Mapping

* T1056

## Artifacts

* Process Inject

## Detailed Summary

The `keylog` command uses the `GetAsyncKeyState` Windows API to log keystrokes and send them back to Mythic. This is done with a stand alone .NET assembly that is loaded with the CLR loader stub used for `execute_assembly`. The CLR loader is injected into the specified process and executes the keylogger assembly, which in turn will begin logging keystrokes and sending them over a named pipe to the agent.

Keystrokes can be found in the `Operational Views > Kelogs` page. These keystrokes are sorted by host, then user, then window title. When new keystrokes are retrieved, a balloon notification will appear in the top right notifying you of the new keystrokes.

<img src="https://mintlify.s3.us-west-1.amazonaws.com/specteropsdocs/mythic-agents/apollo-docs/documentation-payload/apollo/images/keylog01.png" alt="keylogs" />