I just hit upon an idea I have used in the past to distinguish between two instances of the same program, one of which was hung. While Task Manager is open and visible and sorted by CPU usage, I pick up the windows of one of the instances and drag it around quickly. The CPU usage on one of the processes goes up, presumably as that process' paint message is rapidly called (assuming your system does "Show window contents while dragging").
Today I wondered if my system has a keylogger. I imagined a hardware keylogger and thought there might be some way to detect it without dismantling my computer, but the search hits I got were mostly for software keyloggers and using anti-Malware software to detect it. But if you activate Windows Task Manager and then just hit lots of keys on the keyboard (gently!), then any process that is recording them would presumably start using some CPU. I wondered if it would use enough CPU to bring it to the top. When I try it, I can get dwm.exe and csrss.exe and taskhost.exe to come up. I think this shows that it is possible to use this method to find a process that is watching the keyboard, but it takes some discernment.
Does this seem plausible, and is this technique one that is resilient to camouflage methods that malware authors might take?