Remote Access Trojan (RAT).

What is a remote access trojan?

A remote access trojan, often shortened to RAT, is malware that gives an attacker remote control over a computer. The word trojan points to the disguise. The word remote access points to the goal. In MITRE ATT&CK, the entry for the gh0st RAT calls it a remote access tool and says its source code is public and has been used by multiple groups.

The letters RAT are also used for the phrase remote access tool. Both versions of the name appear in practice, and they refer to the same idea of controlling a machine from afar.

How does a RAT work?

MITRE lists what the gh0st RAT can do. Its capabilities include remote command execution, file operations, system reconnaissance and keylogging. It also includes persistence through registry changes and service creation. MITRE also notes that it uses encrypted communications to hide its command and control traffic. Command and control is the link an attacker uses to send orders to the infected machine and receive results.

Not every RAT has the same features. This list describes one documented example, not all of them.

Why does it matter?

A RAT gives an attacker an interactive foothold on a machine. MITRE lists remote command execution, file operations and keylogging for one example, so a single infected computer can expose files and typed information. Because the code of the gh0st RAT is public and used by multiple groups, a tool of this kind is not limited to one actor. Defenders therefore should not treat a RAT as a sign of a single known group.

How can you detect or reduce RATs?

MITRE also describes a related technique called remote access tools, where adversaries use legitimate remote access software to set up interactive command and control. MITRE says such software may be installed after a compromise as an alternate communications channel. It adds that installing many of these tools can include persistence, for example when the installer creates a Windows service.

• Know which remote access software is approved in your organization, so unapproved tools stand out.
• Review services and registry changes for entries nobody can explain.
• Watch for network traffic to destinations that make no sense for the machine.
• Treat an unexpected remote session as a possible sign of compromise.

Is a RAT the same as legitimate remote access software?

No, though they can look alike. Legitimate remote access software is made for support and administration. MITRE notes that adversaries abuse such software after a compromise. A RAT is malware, and it is installed without the owner’s knowledge. The difference is consent, not the technology.

Is a RAT the same as a backdoor?

They overlap. A backdoor is any hidden way into a system. A RAT is a specific kind of program that offers remote control, and it can serve as a backdoor.

Related terms

See also trojan, backdoor and command and control.

Related pages in the Knowledge Hub

• Gh0st RAT

Sources

• MITRE ATT&CK: MITRE describes gh0st RAT as a remote access tool with public source code used by multiple groups, with remote command execution, file operations, keylogging,….
• MITRE ATT&CK: MITRE says remote access tools may be installed post-compromise as an alternate communications channel, and installation can include persistence such as a Windows service.