MassLogger/Snake/AgentTesla Keylogger Hook: AppData/Temp Process + logs.dat Creation

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects execution of potential keylogging software from suspicious paths like AppData or Temp, followed by the creation of a keylogger log file artifact in the specific AppData\Roaming\DT\ directory.