I hate to start out an answer like this, but I do not know if my answer will be 100% correct because there are many ways this could be done. One way could be to hook a DLL into predetermined sniffing processes like wireshark and then make modifications to the process memory to not display any packets being sent to a specific IP Address (the IP Address which is monitoring the keylogger).
I'm sure there are other ways, but if I was attempting to create an anti-wireshark program, that's where I would start as to me it makes sense to do.
The program would simply have to find the static memory address where wireshark prepares information for display, intercept the packets before their displayed and then use a conditional statement to decide whether to allow them to continue on their way to be displayed or whether to stop them from being displayed.
However, it could just be as simple as finding the wireshark process and then calling the console command
taskkill to terminate the process (like you said).