Millenium RAT Keylogger File Written to APPDATA by Non-UI Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects Millenium RAT (or similar malware associated with the Y2K Operators campaign) writing keystroke capture files to user APPDATA directories. The rule specifically monitors file creation events by non-browser/non-UI processes that utilize suspicious file extensions (.g0, .txt, .log, .dat).