5.9.xxxxxx.2196 CIS, Defense + does not warning capture the keyboard

configuration: CIS 5.9.xxxxxx.2196 proactive
defense + mode paranoid
sandbox deactive
firewall mode security
S.O windows 7 SP1 (x64)


the curious thing is that the CIS warning about the killswitch, already on the Ardamax Keylogger not.