Windows File Creation to Roaming AppData DataLogs.conf and RAT-Client Names
Alerts on creation of specific RAT client config files under AppData\Roaming on Windows.
- Product
- windows
- Category
- file_event
- Author
- Joseliyo Sanchez, @Joseliyo_Jstnk (SigmaHQ), DRL 1.1
- Published
- 2024-12-19
- Updated
- 2026-07-31
What it detects
This rule flags Windows file creation events where the target filename contains AppData\Roaming and matches specific configuration-style filenames used by RAT-related samples (e.g., DataLogs.conf, hvnc.conf, dcrat.conf) or paths under mydata/datalogs/hvnc/dcrat. Attackers may drop these client configuration files to establish persistence or operational parameters for remote access tooling. It relies on file event telemetry with the created file path (TargetFilename) to evaluate both directory and filename conditions.
Reporting behind it
- virustotal.comhttps://www.virustotal.com/gui/file/c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
- virustotal.comhttps://www.virustotal.com/gui/file/e96a0c1bc5f720d7f0a53f72e5bb424163c943c24a437b1065957a79f5872675
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/Generic/file_event_win_malware_generic_creation_configuration_rats.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows File Creation to Roaming AppData DataLogs.conf and RAT-Client Names
id: 4061acc0-2ad2-4a5c-969d-63843870c60f
status: experimental
description: This rule flags Windows file creation events where the target filename contains AppData\Roaming and matches specific configuration-style filenames used by RAT-related samples (e.g., DataLogs.conf, hvnc.conf, dcrat.conf) or paths under mydata/datalogs/hvnc/dcrat. Attackers may drop these client configuration files to establish persistence or operational parameters for remote access tooling. It relies on file event telemetry with the created file path (TargetFilename) to evaluate both directory and filename conditions.
references:
- https://www.virustotal.com/gui/file/c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
- https://www.virustotal.com/gui/file/e96a0c1bc5f720d7f0a53f72e5bb424163c943c24a437b1065957a79f5872675
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/Generic/file_event_win_malware_generic_creation_configuration_rats.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2024-12-19
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection_required:
TargetFilename|contains: \AppData\Roaming\
selection_variants:
TargetFilename|contains:
- \mydata\
- \datalogs\
- \hvnc\
- \dcrat\
TargetFilename|endswith:
- \datalogs.conf
- \hvnc.conf
- \dcrat.conf
condition: all of selection_*
falsepositives:
- Legitimate software creating a file with the same name
level: high
license: DRL-1.1
related:
- id: 2f3039c8-e8fe-43a9-b5cf-dcd424a2522d
type: derived