TA4922 Atlas RAT/HoldingHands: Keylogger Hook + C2 Correlation (T1056.001)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects processes running from common user-writable directories (AppData, Temp, ProgramData, etc.) that concurrently establish outbound network connections to non-private (non-RFC1918) IP addresses. It explicitly excludes common browsers, accessibility tools, and known Windows system or product-related paths to reduce noise.