TA4922 Atlas RAT / ValleyRAT Process Injection into svchost or explorer

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects potential process injection attempts by Atlas RAT or ValleyRAT malware into system processes such as svchost.exe or explorer.exe. The rule identifies suspicious execution originating from user-writable directories (e.g., Temp, AppData) when spawning these critical processes, which deviates from standard system-based spawning patterns.