Atlas RAT Sandbox Evasion via WDAG Registry Check

Duo Tech@duotech

•updated Jun 5, 2026•0•0•3

Detects registry interactions querying or accessing the Windows Defender Application Guard (WDAG) RunOnce registry key. This behavior is associated with Atlas RAT performing anti-sandbox and anti-analysis checks prior to payload execution.