TA4922 Atlas RAT Process Hollowing via Remote Thread Injection and Full Process Access

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects evidence of process hollowing and injection techniques associated with the TA4922 (Silver Fox) threat actor. The rule monitors for three primary indicators: remote thread creation into common target processes (svchost, explorer, etc.) by non-system images, process access with high privilege handles (0x1fffff/0x1f3fff) targeting those same processes, and the execution of system binaries from non-standard filesystem locations.