TA4922 Atlas RAT Process Hollowing via Suspicious svchost or notepad Spawn

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects process hollowing behavior indicative of the Atlas RAT loader used by TA4922. The rule monitors for the spawning of svchost.exe or notepad.exe by non-standard parent processes located outside legitimate system directories, which is a common indicator of process injection and masquerading techniques.