AstarionRAT - Keylogger Hook Execution (T1056.001)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•2•0•4

Detects AstarionRAT installing a global keyboard hook (SetWindowsHookEx) to capture user keystrokes. This rule relies on advanced API tracking telemetry to identify the SetWindowsHookExApiCall action type and then joins with process events to filter for executables running from the AppData folder.