BeepRAT/DcRAT OffLineKeyLogger Module Activation via WH_KEYBOARD_LL Hook

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects execution patterns associated with the BeepRAT malware family. It identifies the presence of known loaders (HFY.exe or tcc.exe) or processes exhibiting specific command-line arguments and configuration loading behavior often used by this malware. The rule also aims to identify child process activity consistent with keyboard hooking.