1. A method for identifying a key logging activity, the method comprising: establishing by a portable computing device a secure connection to a management server; obtaining at the portable computing device over the established secure connection one or more updates to a first set of rules; establishing another separate connection between the portable computing device and a host computing device; identifying by the portable computing device one or more processes running on the host computing device; identifying by the portable computing device one or more hooking operations performed in the one or more identified processes; identifying by the portable computing device one or more suspected key logging actions from the one or more identified hooking operations based on one or more of the first set of rules; identifying by the portable computing device from the identified one or more suspected key logging actions one or more suspected aggressive key logging actions based on one or more of a second set of rules; and outputting by the portable computing device the one or more identified suspected key logging actions and the one or more identified suspected aggressive key logging actions.