Detects PowerShell scripts that contains reference to keystroke capturing functions

Detect attempt to enable auditing of TTY input

Adversaries may log user keystrokes to intercept credentials as the user types them.