Atlas RAT Sandbox Evasion (WDAG Registry Check)

Ethan Andrews@eandrews

•updated Jun 4, 2026•2•0•7

Detects Atlas RAT anti-analysis behavior by monitoring for interactions with the Windows Defender Application Guard (WDAG) RunOnce registry key. This is a known sandbox evasion technique used by TA4922 before executing its primary payload.