Atlas RAT / ValleyRAT Keylogging via Keyboard Hook or Output File Write

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects potential keylogging activity by identifying either low-level Windows keyboard hooks initiated by suspicious processes or the creation of suspicious log files in user-writable directories by unsigned processes. It filters out common, trusted browser processes and signed Microsoft binaries to reduce noise.