Trojan.

What Is a Trojan?

NIST defines a Trojan horse as a computer program that appears to have a useful function, but also has a hidden and potentially malicious function that evades security mechanisms. Another NIST definition calls it a useful or seemingly useful program that contains hidden code of a malicious nature, which executes when the program is invoked. In short, it looks like one thing and does another.

People often shorten the name to Trojan. A Trojan is one kind of malware. NIST defines malware as software or firmware intended to perform an unauthorized process that will have an adverse impact on the confidentiality, integrity, or availability of a system. NIST lists Trojan horses next to viruses, worms and spyware as common examples.

How Does a Trojan Get a User to Run It?

The key idea is disguise. The user sees a program that seems useful and runs it. The hidden code then runs when the program is invoked. This is the point of the name: the harmful part arrives inside something that looks acceptable.

The hidden function can differ from case to case. NIST describes it only as hidden and potentially malicious. As a simple illustration, a program could offer one feature on the surface while a second, unseen part does something else. This is a generic example and not a description of any one family.

Why Can a Trojan Slip Past Security Checks?

A Trojan does not need to break in by force. It relies on someone choosing to run it. NIST says the hidden function evades security mechanisms, which suggests that a program that looks harmless may not be caught by simple checks. For this reason, careful habits about what software is installed matter as much as technical tools.

Which Habits Lower the Risk of a Trojan?

These steps follow from the definitions above. They are general, and they are not a complete defense.

• Install software only from sources you trust and have a reason to use.
• Treat a program that offers one thing but asks for more access than it needs with suspicion.
• Keep security tools and system updates current so that known threats are easier to catch.
• Watch for behavior that does not match what a program claims to do.

Which ATT&CK Techniques Match a Trojan?

MITRE ATT&CK has no single Trojan technique. It describes the parts of the behavior in separate techniques, listed below.

Is a Trojan the Same as a Virus?

No. NIST lists viruses, worms and Trojan horses as separate examples of malware. The defining feature of a Trojan is that it pretends to be useful. A virus or a worm is defined by other traits. Many people say virus when they mean any malware, but the terms are not identical.

Is a Trojan the Same as a Remote Access Trojan?

Not quite. A Trojan is the wider category, defined by disguise. A remote access trojan is a type that gives an attacker remote control of a machine. All remote access trojans are Trojans in the sense of the name, but a Trojan can have many other hidden purposes.

Related Terms

See also remote access trojan, backdoor and malware loader.

Related Pages in the Knowledge Hub

• Emotet malware profile
• Gh0st RAT malware profile
• Obfuscated Files or Information technique

Sources

• NIST: NIST defines a Trojan horse as a program that appears useful but has a hidden, potentially malicious function that evades security mechanisms.
• NIST: NIST defines malware as software or firmware intended to perform an unauthorized process with adverse impact on confidentiality, integrity or availability, and lists Trojan horses among common examples.
• MITRE ATT&CK: Masquerading: making artifacts look legitimate or benign.
• MITRE ATT&CK: Match Legitimate Resource Name or Location: trusted names and folders.
• MITRE ATT&CK: User Execution, Malicious File: a user opens a file to run code.
• MITRE ATT&CK: Compromise Software Supply Chain: modified software releases.