BQTLock: Remcos RAT deployment via process injection and ASEP persistence

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects the deployment and activity of the Remcos Remote Access Trojan (RAT) as part of the BQTLock (BaqiyatLock) attack chain. This rule monitors for process injection into critical Windows processes, malicious Run key persistence entries, non-standard outbound TLS communication from non-browser processes, and the creation of potential keylogging artifacts in the AppData directory.