Atlas RAT Process Hollowing into Legitimate Host Processes

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects suspicious cross-process activity, such as process hollowing, where an unsigned or unusually located process (e.g., in AppData, Temp, or Downloads) attempts to inject code into legitimate Windows system processes like svchost.exe or explorer.exe.