Remcos RAT WH_KEYBOARD_LL Offline Keylogging via keylogger.dat
This rule monitors for suspicious file creation and process execution indicative of the Remcos Remote Access Tool. It specifically looks for the creation of files containing 'keylogger.dat' or 'logs' in the user's AppData directory, as well as the execution of processes with 'remcos.exe' or 'remcos' in the path or command line arguments, signaling potential keylogging or remote control activity.
Splunk (SPL)
