Keylogger Files In Microsoft Vault Directory

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•2•0•2

This rule detects the creation of files named 'lgf.dat' or 'lg.dat' within a user's Microsoft Vault directory. These file names and location are associated with keylogger activity, specifically as observed in the 'Fishmongers' Arsenal' campaign involving SprySocks malware.