Payouts King/TA4922: Atlas RAT Sideloaded Process with Outbound HTTP/HTTPS C2

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects processes executing from commonly abused, high-write temporary or user-specific directories (AppData, Temp, ProgramData) that simultaneously initiate network connections to external IP addresses over HTTP/HTTPS ports (80/443). This pattern is frequently indicative of initial stage malware, downloader behavior, or command and control communication originating from non-standard execution paths.