TA4922 Atlas RAT Keylogger Hook Setup via user32.dll Load from User-Writable Path

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects the loading of user32.dll or ntdll.dll by processes running from suspicious, user-writable directories (e.g., AppData, Temp, Public). This pattern is consistent with TA4922 Atlas RAT and other implants attempting to install keyboard hooks for input capture via SetWindowsHookEx or GetAsyncKeyState.