Atlas RAT / ValleyRAT Screen Capture and Webcam Surveillance Activity
Detects potential surveillance activity by monitoring for screenshot image files written to suspicious directories (such as Temp or AppData) by non-whitelisted processes, and identifies unauthorized access to camera or video capture devices by processes that are not standard conferencing or imaging software. This rule is designed to detect capabilities often associated with Remote Access Trojans (RATs) such as AtlasRAT and ValleyRAT.
Microsoft Sentinel (KQL)
