Keystroke Input Capture via DirectInput

api where process.executable : "C:\\*" and 

 process.thread.Ext.call_stack_final_user_module.name : "dinput*.dll" and 
 
 (process.code_signature.exists == false or 
  process.code_signature.status == "errorBadDigest" or 
  process.code_signature.subject_name in ("The MathWorks, Inc.", "AutoIt Consulting Ltd", "Python Software Foundation") or 
  (process.code_signature.subject_name in ("Microsoft Windows", "Microsoft Corporation") and process.executable : "?:\\Windows\\*" )) and 
  
  (process.Ext.api.name == "RegisterRawInputDevices" and
   process.Ext.api.parameters.usage == "KEYBOARD" and process.thread.Ext.call_stack_summary like "*
| dinput?.dll
| *") and 
   
  not process.executable : ("?:\\Windows\\System32\\dxdiag.exe", "?:\\Windows\\SysWOW64\\dxdiag.exe") and 
  not (process.executable : "?:\\Windows\\System32\\rundll32.exe" and 
       process.command_line : "?:\\WINDOWS\\system32\\rundll32.exe ?:\\WINDOWS\\system32\\inetcpl.cpl,ClearMyTracksByProcess*") and 
  not (process.executable : "?:\\Windows\\Sys*\\regsvr32.exe" and process.command_line : "*\\Program Files*\\LGHUB\\sdks\\sdk_legacy_steering_wheel*") and 
  not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*", 
                            "?:\\Windows\\System32\\Macromed\\Flash\\FlashUtil_ActiveX.exe") and
  not process.thread.Ext.call_stack_summary like
              "wow64win.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| win32u.dll
| dinput8.dll
| Unknown*"