MassLogger RAT Loader Activity via PowerShell or RemotePC

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•0

Detects the execution of MassLogger RAT components where the command line contains 'masslogger', 'mass.logger', or 'logger.exe', specifically when initiated by PowerShell or a process associated with 'RemotePC'. This rule aims to identify the loading or execution phase of the MassLogger RAT.