Atlas RAT / Gh0stRAT Keylog File Written to TEMP or APPDATA
Detects processes executing from user-writable directories (e.g., Temp, AppData, Downloads) that create files in Temp or AppData directories, specifically excluding common browser processes. This behavior is consistent with the post-exploitation activity of remote access trojans (RATs) such as Atlas RAT or Gh0stRAT, which may log keystrokes to a local file.
YARA-L
