BeepRAT Offline Keylogger Activation via SetWindowsHookEx WH_KEYBOARD_LL
Detects suspicious process activity, module loading, and function calls indicative of the BeepRAT malware family. The rule monitors for keyboard hooking via SetWindowsHookEx, the presence of specific keylogger-related command-line arguments, and the execution or loading of files associated with BeepRAT lure binaries.
Splunk (SPL)
