TA4922 Atlas RAT / ValleyRAT Process Injection into svchost or explorer

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects Atlas RAT and ValleyRAT patterns involving process injection into svchost.exe or explorer.exe by an unauthorized process originating from a user-writable directory (e.g., Temp, AppData, Downloads). The rule correlates process injection events with preceding suspicious process launches.