Remcos RAT WH_KEYBOARD_LL Hook and keylogger.dat File Creation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule monitors for potential keylogging behavior by detecting the use of Windows hooks (SetWindowsHookEx, GetAsyncKeyState), the creation of files named 'keylogger.dat' or 'keylogger', and files created in AppData with a .dat extension by unauthorized processes. It includes exclusions for common legitimate system and application processes to minimize noise.