Atlas RAT check-in marker in process command line
This rule looks for command-line text associated with Atlas remote-access malware checking in to its controller. That check-in means the machine may already be under outsider control. Isolate the host and begin incident response if confirmed. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Microsoft Sentinel (KQL)
