Remcos RAT Clipboard Data Theft via remcos.exe and keylogger.dat Write

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects the execution of the Remcos Remote Access Trojan (RAT) followed by the creation of a keylogger data file by the same process, within a one-hour timeframe. This pattern indicates an active infection where the RAT is performing credential harvesting through keystroke logging.