Atlas RAT C2 Beaconing, Keylogging, and Browser Credential Access
This rule monitors for a combination of suspicious behaviors including C2 network activity to known malicious IPs, potential credential theft targeting browser data files, suspicious library loading (such as keyloggers or potential sideloading) from temp or appdata directories, and beaconing activity using non-standard or suspicious processes. The rule calculates a risk score based on the number and type of indicators observed on a single host.
Splunk (SPL)
