TA4922 Atlas RAT Process Hollowing via Suspended svchost or notepad Spawn

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects a process hollowing technique where legitimate system processes (svchost.exe or notepad.exe) are spawned by non-standard parent processes, followed by suspicious memory manipulation API calls (such as NtUnmapViewOfSection, NtWriteVirtualMemory, or NtResumeThread) from an non-system process, indicative of malicious code injection.