Abyssos Keylogger Module Artifacts And Hook

Duo Tech@duotech

•updated Aug 11, 2026•0•0•1

Detects Abyssos RAT KEYLOGGER module by requiring SetWindowsHookEx-style capture strings to co-occur with the klog-prefixed drop artifact or windows_update_cache.json log file, reducing false positives from generic hook installers; also flags XOR key, export function abyss, and KEYLOGGER_GETLOGS command