I wouldn&#x27;t call it a false positive, since it was definitely logging keys. I view it more like a sudo prompt.<p>From my experience there are very few legit reasons for intercepting keys, and the use cases you mentioned are better solved by implementing a device driver (which would be signed by MS).<p>Allowing non-elevated code to install system hooks also enlarges the attack surface, since now a malware piece can just infect your keyboard layout translator for getting keyboard access.<p>Me, I would like an Intent&#x2F;Permission mechanism on Windows, where certain actions like keylogging or accessing other processes memory require explicit white-listing (like on Android&#x2F;iOS). Currently some actions do require a certain privilege, but that privilege is granted per-user, not per-app, so it doesn&#x27;t help that much.