TA4922 Malware Execution from Temp Directory via Email/Browser Child Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•4•0•6

Detects the execution of known malware families (Atlas RAT, RomulusLoader, SilentRunLoader) or processes spawned from temporary directories (AppData/Local/Temp, AppData/Roaming/Temp, Windows/Temp) by common email clients, browsers, and file archivers. This behavior is indicative of a user-initiated execution of a malicious payload, typically associated with phishing or drive-by download attacks.