BeepRAT Offline Keylogger Thread Activation via DcRAT-Derived Implant

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•2

Detects the activation of BeepRAT's offline keylogger component. The rule identifies the execution of loader components or associated processes (such as Tiny C Compiler, LuaJIT, or custom named binaries) that facilitate the installation of a low-level keyboard hook (WH_KEYBOARD_LL) to intercept user input, which is then stored locally for later exfiltration.