BabylonRAT keylogger writes ConfigsEx\ClipBoard.txt output file

Arnold Chan@slaz

•updated 23 days ago•0•0•2

This rule detects the creation or modification of a file named 'ClipBoard.txt' within the directory 'AppData\Roaming\ConfigsEx\', as well as the creation of the 'ConfigsEx' directory using command-line tools. This behavior is indicative of an adversary staging sensitive information, such as harvested clipboard data, for potential exfiltration.