Possible Remcos RAT Loader File Exfiltration

Ankit Mehta@Secvyn

•updated Jun 23, 2026•5•0•11

This rule detects the creation of a 'logs.dat' file, which is often associated with Remcos RAT for data exfiltration, in common user-related directories (AppData, Temp, Users, Documents) with a file size greater than or equal to 100KB. This pattern suggests an attempt to stage or exfiltrate collected data.