Atlas RAT / ValleyRAT Keylog Output File Written from User-Writable Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects the creation or modification of common log file types (e.g., .log, .txt, .dat, .kl) by unsigned, non-standard processes executing from high-risk directories like AppData, Temp, or ProgramData. This behavior is indicative of potential keylogging activities associated with remote access trojans (RATs) such as Atlas RAT or ValleyRAT.