DcRAT Screen Capture and Keylogging via c:\debug.txt (Operation DragonReturn)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects DcRAT malware creating or modifying a specific file (c:\debug.txt) used for staging keylogging or screenshot data. This rule monitors for file creation followed by modification events, a pattern associated with the adversary's method of log consolidation and potential obfuscation.