Looks like a keylogger file created by DarkComet Malware

Hunt Hypothesis

This hunt targets adversaries deploying DarkComet malware to establish persistence and exfiltrate sensitive credentials through stealthy keylogging mechanisms on Azure endpoints. Proactively hunting for this behavior in Azure Sentinel is critical because early detection of these specific file artifacts allows the SOC team to isolate compromised hosts before attackers can escalate privileges or extract high-value data.

YARA Rule

rule DarkComet_Keylogger_File  : RAT
{
	meta:
		author = "Florian Roth"
		description = "Looks like a keylogger file created by DarkComet Malware"
		date = "25.07.14"
		reference = "https://raw.githubusercontent.com/Neo23x0/Loki/master/signatures/thor-hacktools.yar"
		score = 50
	strings:
		$magic = "::"
		$entry = /\n:: [A-Z]/
		$timestamp = /\([0-9]?[0-9]:[0-9][0-9]:[0-9][0-9] [AP]M\)/
	condition:
		($magic at 0) and #entry > 10 and #timestamp > 10
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

False Positive Guidance

Here are 4 specific false positive scenarios for the DarkComet Keylogger detection rule in an enterprise environment, along with suggested filters:

Scenario: Deployment of Enterprise Endpoint Detection and Response (EDR) Agents via Group Policy.
- Context: When tools like CrowdStrike Falcon, Microsoft Defender for Endpoint, or Carbon Black are updated or installed via GPO, they often create a background service file in the C:\ProgramData or C:\Windows\System32\drivers directory. These files frequently utilize similar naming conventions (e.g., generic names like sysmon_log.exe or specific DLLs) and registry keys that mimic the behavior of DarkComet’s keylogger component to hook into input streams for telemetry collection.
- Suggested Filter: Exclude file paths containing known EDR vendor directories (e.g., \ProgramData\CrowdStrike\, \Windows\System32\Microsoft Defender Antivirus\) and filter by the specific ImageName or Publisher signature of the legitimate EDR software.
Scenario: Execution of Scheduled Remote Desktop Session Recording Tasks.
- Context: In environments using Citrix Virtual Apps or Windows Remote Desktop Services (RDS), administrators often schedule tasks to record user sessions for compliance auditing. These scheduled jobs (triggered by Task Scheduler) create temporary log files and inject hooks into the session process to capture keystrokes and screen data, which can generate file creation events indistinguishable from DarkComet’s keylogger artifacts.
- Suggested Filter: Create an exclusion based on the ParentProcessName being svchost.exe (specifically the TaskScheduler service) or RdpClip.exe, and restrict the rule to trigger only if the file creation occurs outside of standard business hours for non-scheduled events.
**Scenario