Remcos RAT Keylogging via SetWindowsHookEx WH_KEYBOARD_LL and keylogger.dat

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the presence of file artifacts associated with known keyloggers (keylogger.dat, remcos.log) or files containing 'keylog' within the AppData\Roaming directory, which is a common persistence location for malware.