Remcos RAT Keylogger DAT File Created by Non-Standard Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the creation of a 'keylogger.dat' file in common writable directories (AppData, Temp, ProgramData) by non-standard system processes. This is a behavioral indicator commonly associated with the Remcos Remote Access Trojan (RAT), which uses low-level keyboard hooks to capture input and save the data to a local file for exfiltration.