Windows has implemented quite a few tricks to make this very difficult without setting off antivirus engines
That's funny because we have been shipping a commercial Windows app since XP that is keylogger-based using SetWindowsHookEx, and it has only tripped users' antivirus maybe 1 or 2 times in 20 years.
I wonder if there's a desktop distro out there that enforces sandboxed applications by default.
EasyOS is the first distro I've seen that at least runs every app as its own user by default, similar to Android.