TA4922 Atlas RAT / ValleyRAT HTTP C2 Beaconing on Port 886
Detects HTTP POST beaconing behavior to known infrastructure associated with Atlas RAT and ValleyRAT malware, linked to TA4922 campaigns. The rule monitors for repeated connections to specific C2 IP addresses on TCP port 886.
YARA-L
