BeepRAT WH_KEYBOARD_LL Hook via user32.dll Load from User-Space Directory

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

This rule detects processes running from suspicious temporary directories (e.g., AppData, Windows Temp) that load 'user32.dll' and subsequently create or write to log files in user or application directories. This behavior is highly indicative of keylogging, where malware hooks input functions via user32.dll and stores captured data in local log files for later exfiltration.