Quasar RAT Keylogging and Remote Desktop C2 Control Activity

Ibrahim Saud@tektrix

•updated Sep 20, 2026•1•0•6

This rule detects potential Quasar RAT post-infection activity by correlating the identification of keystroke logging API usage (specifically SetWindowsHookEx, GetAsyncKeyState, or GetKeyboardState) followed by an outbound network connection from the same process identifier within a ten-minute window, indicative of remote control functionality.