Sprysocks Vault Keylogger Files Detection

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•2

This rule detects the presence of specific files and API calls associated with the SprySocks malware, which functions as a keylogger. It looks for 'lgf.dat' and 'lg.dat' files within a 'Microsoft\Vault' directory, combined with the presence of keylogging-related API functions like 'GetClipboardData', 'GetForegroundWindow', and 'GetAsyncKeyState'. This combination indicates potential keylogger activity on a Windows system.