Remote Access Trojans (RATs) : detect, investigate, contain, and remediate

1. What Is a Remote Access Trojan (RAT)?

A Remote Access Trojan (RAT) is a class of malware that provides an attacker covert, persistent, and unauthorized remote control over an infected system. Unlike legitimate remote administration tools, RATs operate without user consent, hide their presence, and are commonly used for:

Espionage & surveillance
Credential theft
Data exfiltration
Lateral movement
Long-term persistence (APT activity)

RATs often function as full-featured backdoors.

2. Typical RAT Architecture

2.1 Infection Chain (High-Level)

Initial Access
- Phishing email (malicious attachment/link)
- Drive-by download
- Trojanized software / cracked tools
- Supply chain compromise
Execution & Installation
- Drops payload
- Installs persistence
- Establishes C2 communication
Command & Control (C2)
- Attacker sends commands
- RAT executes them and returns results
Post-Exploitation
- Credential theft
- Surveillance
- Lateral movement
- Data exfiltration

3. Core Capabilities of RATs

Capability	Description
Remote Shell	Execute OS commands
File Management	Upload/download/delete files
Credential Harvesting	Browser, system, VPN credentials
Keylogging	Capture keystrokes
Screen Capture	Screenshots or live desktop
Webcam/Mic Access	Audio/video spying
Process Control	Start/kill processes
Registry Manipulation	Persistence and evasion
Lateral Movement	SMB, RDP, WMI abuse
Self-Update	Download new modules
Defense Evasion	Disable AV, logging

4. Malicious Payload Types (Conceptual)

Note: Payload descriptions are categorical, not implementation guidance.

4.1 Payload Delivery Types

Executable loaders (EXE, DLL)
Script-based loaders (PowerShell, JS, VBA)
Memory-only payloads (fileless)
Side-loaded DLLs
Macro-based payloads

4.2 Functional Payload Categories

Payload Type	Purpose
Backdoor Module	Persistent access
Info-Stealer	Credentials, cookies, tokens
Surveillance Module	Keylogging, screenshots
Downloader	Fetch additional malware
Lateral Movement Tool	Spread internally
Persistence Module	Survive reboot
Evasion Module	Obfuscation, anti-analysis
Destructive Payload	Wipers (rare but possible)

5. Persistence Mechanisms Used by RATs

5.1 Common Techniques

Registry Run keys
Scheduled Tasks
Startup folders
Services (Windows)
Launch Agents / Daemons (macOS/Linux)
WMI Event Subscriptions
Bootkits (advanced)

6. Command & Control (C2) Communication

6.1 C2 Protocols

HTTP / HTTPS
DNS tunneling
WebSockets
TCP/UDP custom protocols
Cloud services abuse (GitHub, Discord, Telegram)

6.2 C2 Evasion Techniques

Encrypted traffic
Domain Generation Algorithms (DGA)
Fast-flux DNS
Legitimate-looking User-Agents
Domain fronting

7. Indicators of Compromise (IOCs)

7.1 Network IOCs

Type	Examples
Suspicious Domains	Randomized/DGA domains
IP Addresses	Known C2 infrastructure
Beaconing	Regular periodic traffic
DNS Anomalies	High NXDOMAIN rate
TLS Indicators	Self-signed or rare certs
Protocol Abuse	DNS/HTTPS for data exfilteration

7.2 Host-Based IOCs

Category	Examples
Files	Unknown executables in temp/appdata
Processes	Unsigned binaries with network access
Registry	Unknown autorun entries
Services	Suspicious auto-start services
Scheduled Tasks	Random or hidden task names
Memory	Injected code into legit processes

7.3 Behavioral IOCs

Behavior	Description
Credential Access	LSASS access attempts
Screenshot Activity	Frequent GDI calls
Keylogging	Low-level keyboard hooks
Evasion	Disabling security tools
Privilege Escalation	Exploit attempts

8. Incident Response (IR) for RAT Infections

8.1 Preparation

EDR deployed
Network logging enabled
Threat intelligence feeds
Incident playbooks ready

8.2 Identification

Alerts from EDR/AV
Anomalous outbound traffic
User reports (slow system, webcam light)
Threat intel matches

8.3 Containment

Isolate infected hosts
Block C2 domains/IPs
Disable compromised accounts
Suspend suspicious services/tasks

8.4 Eradication

Remove malware binaries
Kill malicious processes
Remove persistence mechanisms
Patch exploited vulnerabilities
Reset credentials

8.5 Recovery

Reimage systems (preferred)
Restore from clean backups
Monitor for reinfection
Re-enable services gradually

8.6 Lessons Learned

Improve detection rules
Update email/web filtering
User awareness training
Threat hunting improvements

9. Detection & Defense Strategies

Layer	Controls
Endpoint	EDR, application allowlisting
Network	IDS/IPS, DNS monitoring
Identity	MFA, credential hygiene
Email	Phishing protection
User	Security awareness training
SOC	Threat hunting

10. Summary Table (High-Level)

Category	Details
Malware Type	Remote Access Trojan
Primary Goal	Stealthy remote control
Persistence	Registry, tasks, services
C2 Channels	HTTP/S, DNS, cloud
Payloads	Backdoor, stealer, spyware
Key IOCs	Beaconing, autoruns, unknown binaries
IR Priority	Immediate isolation
Best Remediation	Full system reimage