Atlas RAT Execution, Persistence, or Anomalous sshd Outbound Connection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule monitors for signs of Atlas RAT activity on Linux systems, including the execution of processes matching known Atlas RAT naming conventions, unauthorized modifications to system persistence mechanisms (systemd or init.d directories) by non-package management utilities, and anomalous outbound network connections originating from sshd or PAM-related processes.