TA4922 Atlas RAT / Gh0stRAT Keylog File Written to TEMP or APPDATA
Detects the creation of log or data files in temporary directories (e.g., AppData, Temp) by non-standard processes. This behavior is indicative of keylogging activity performed by malware families such as Atlas RAT and Gh0stRAT, commonly associated with the threat actor TA4922.
YARA-L
