Remcos RAT Keylog File Creation in AppData\Roaming\DT\logs.dat

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the creation or modification of a specific log file at AppData\Roaming\DT\logs.dat on Windows systems, a known indicator of behavior associated with the Remcos Remote Access Trojan (RAT) for capturing and storing keystrokes.