Microsoft Vault keylogger control and output

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•2

This rule detects the creation of specific files (lgf.dat or lg.dat) within a user's Microsoft Vault directory, which are indicative of keylogger activity. The rule leverages Cortex XDR data to provide causality and actor information for investigation.