Intercept X advanced With EDR query for a keylogger

Question

Hi , 
 I have a keylogger written in python listening and sending a file containing the keys pressed by the user to an email every time the user press esc. i want to detect it using Sophos edr by a query that look to a process sending a file periodically or by looking in the system for process that is listening for keys. Does this query exist or should i create one my own. if anyone know how please share. 
 
 THANKS !!!!!!!!!! 
 
 Regards.

Yashraj S · Answer

Hi Youcef Rahmouni , 
 I believe this is something that you'll have to create on your own. You can repost this in the Live Discover and Response Query Forum and see what other users say about it.