What Is a Remote Access Trojan (RAT)?

Remcos adds itself to HKCU\Software\Microsoft\Windows\CurrentVersion\Run and then does nothing until an operator connects. That pause is the whole point.

A remote access trojan is not a payload that runs to completion. It is a control channel with a human on the other end, waiting. Everything that makes a RAT useful to an operator (interactivity, breadth of capability, long dwell) is also what makes it noisy. MITRE tracks the legitimate-software version of this as Remote Access Tools, T1219, which as of ATT&CK v19 carries three sub-techniques including Remote Desktop Software (T1219.002).

The capability set

Commodity RATs converge on the same feature list because operators want the same things. Mapped to real techniques, with families MITRE documents doing each:

• Remote shell. T1059.003. The operator gets cmd.exe with stdin and stdout redirected over the C2 socket.

• File transfer in both directions. T1105. Remcos can upload and download files. njRAT can pull additional payloads.

• Keylogging. T1056.001. Remcos, njRAT and AsyncRAT all ship a keylogger.

• Screen capture. T1113. njRAT captures screenshots, Remcos takes them automatically on a timer.

• Webcam access. T1125. njRAT and Remcos can both reach the camera.

• Credential theft. T1555.003 against browser password stores, plus whatever the keylogger picks up.

• Persistence. T1547.001 Run keys and Startup shortcuts, or T1053.005 scheduled tasks. AsyncRAT creates a scheduled task to survive reboot.

None of that is exotic. It is a support technician's toolkit pointed the wrong way.

The operator workflow that produces it

The reason process telemetry is so productive against RATs is that a person is driving. Automated malware executes a fixed graph. A human types, pauses, mistypes, and changes their mind.

The sequence below is a reconstruction of a typical hands-on session based on published RAT tradecraft. It is not captured telemetry from an intrusion.

1. implant checks in, host appears in the operator panel
2. operator opens a remote shell
3. whoami /groups
4. net user /domain
5. nltest /dclist:
6. screen capture, to check whether the user is at the keyboard
7. file transfer of a second stage into %APPDATA%

Steps 3 through 5 land inside a minute or two and share one parent process. That burst is the signal.

Persistence artifacts

Start here because it is cheap and it survives reboots. njRAT adds a Run value and drops a shortcut into the Startup folder. Remcos uses the same Run key. AsyncRAT prefers a scheduled task.

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\
schtasks.exe /create /sc onlogon /rl highest /tn <task> /tr <path>

Collect Sysmon Event ID 13 (RegistryEvent, value set) for the Run keys, Event ID 11 (FileCreate) for the Startup folder, and Event ID 1 or Security 4688 for the schtasks.exe invocation. Where the RAT installs as a service instead, System log 7045 from Service Control Manager carries the image path.

The weakness of persistence-only detection is that it fires once, at install, and a RAT that lives only in a scheduled task you already whitelisted never fires again.

The beacon

An idle RAT still talks. The operator needs the session to be there when they sit down. That produces a long-lived low-volume flow, or a repeated connect and teardown, to the same destination.

Fixed-interval check-ins are trivially periodic. The inter-arrival deltas cluster tightly, so the standard deviation over the mean stays near zero across hundreds of connections. Jitter exists to break that. A random percentage band around the sleep widens the distribution without removing the underlying periodicity, and the byte counts stay small because nothing is transferred between commands.

What we collect for this:

• Sysmon Event ID 3 for the network connection, with Image so the flow is attributed to a process rather than a host.

• Sysmon Event ID 22 for DNS queries, which is where dynamic DNS and free hosting domains show up.

• Zeek conn.log for duration and byte counts, ssl.log for the JA3 and certificate subject.

SigmaHQ ships dns_query_win_remote_access_software_domains_non_browsers.yml, which flags queries to known remote access software domains from processes that are not browsers. That is a good template for the idea even when the family is not a commercial tool.

The process tree a human creates

This is the durable detection. When the operator opens a shell, the RAT process becomes the parent of cmd.exe or powershell.exe. The RAT is usually running from a user-writable directory, because that is where the dropper put it.

explorer.exe
  └─ <implant>.exe        C:\Users\<user>\AppData\Roaming\<name>.exe
       └─ cmd.exe /c whoami /groups
            └─ conhost.exe 0xffffffff -ForceV1
       └─ cmd.exe /c net user /domain
       └─ cmd.exe /c nltest /dclist:

A redirected cmd.exe with no visible window still allocates a console host, so the conhost.exe child shows up in Sysmon Event ID 1 anyway. We tested this on Windows 11 23H2 and Server 2022. We did not test it on Server 2016.

The unusual pair is not cmd.exe itself. It is the parent: an executable under C:\Users\, C:\ProgramData\ or C:\Windows\Temp\ acting as a shell parent, several times in a row.

Commodity families, and honest attribution

njRAT (also tracked as Bladabindi) was first observed in 2012. DarkComet is an older Windows remote administration tool and backdoor. gh0st RAT has had public source code for years, which is exactly why it appears under many different names. NanoCore is a modular .NET tool in use by threat actors since 2013.

Attribution for commodity RATs is weak by construction, because anyone can download them. MITRE records QuasarRAT use by menuPass (G0045), Patchwork, Gorgon Group, Kimsuky, APT-C-36, BackdoorDiplomacy and LazyScripter. Remcos, which Breaking Security markets as remote control and surveillance software, is recorded for Gamaredon Group, Gorgon Group, APT-C-36 and LazyScripter. AsyncRAT, originally published through the NYANxCAT GitHub repository, is recorded for APT-C-36, TA2541 and MirrorFace.

Seeing one of these does not tell you who is on the keyboard. It tells you someone is.

The legitimate-tool overlap

ScreenConnect, AnyDesk, TeamViewer, NetSupport, MeshAgent, Atera and Splashtop are functionally identical to a RAT. Remote shell, file transfer, screen view, unattended access, service persistence. They are signed, they are allowed, and intrusion sets install them precisely because of that.

SigmaHQ carries more than twenty rules under the proc_creation_win_remote_access_tools_* naming pattern for this reason. The pattern to copy is the ScreenConnect hunting rule, d1a401ab-8c47-4e86-a7d8-2460b6a53e4a, titled "Remote Access Tool - ScreenConnect Remote Command Execution - Hunting". Its entire detection body is one condition:

detection:
    selection:
        ParentImage|endswith: '\ScreenConnect.ClientService.exe'
    condition: selection

It does not decide whether the command is malicious. It surfaces every child of the remote access service and leaves triage to the analyst. Its stated false positive is blunt: legitimate commands launched from ScreenConnect will also trigger it.

A behavioural rule

This one targets the operator, not the family. It fires on a shell or discovery binary whose parent lives in a user-writable path.

title: Discovery command spawned by a process in a user writable path
id: 4f0d0d1c-2a5f-4a8f-9c8b-6a1f3c2f8b41
status: experimental
description: |
    Detects shell and host discovery binaries spawned by a parent executable
    running from a user writable directory. This is the shape hands-on-keyboard
    activity takes when an operator drives a remote access implant, independent
    of malware family.
author: HuntRule
date: 2026-07-31
tags:
    - attack.execution
    - attack.discovery
    - attack.t1059.003
    - attack.t1219
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|startswith:
            - 'C:\Users\'
            - 'C:\ProgramData\'
            - 'C:\Windows\Temp\'
            - 'C:\PerfLogs\'
            - 'C:\Users\Public\'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\whoami.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\nltest.exe'
            - '\systeminfo.exe'
            - '\tasklist.exe'
            - '\quser.exe'
            - '\ipconfig.exe'
            - '\arp.exe'
    condition: all of selection_*
falsepositives:
    - Software installers and updaters that unpack to a temp directory and shell out
    - RMM agents deployed under C:\ProgramData, including Atera, NinjaOne and Tactical RMM
    - Developer tooling and CI runners executing from a user profile
    - Login scripts staged in C:\Users\Public
level: medium

On its own this rule is noisy in any environment with RMM software, which is most of them. Pair it with a Sigma correlation so a single command does not alert but a burst does:

title: Discovery burst from one implant parent
id: 9b6e2d54-7c31-4a1e-b0d6-1f5f9a7c2e30
status: experimental
correlation:
    type: event_count
    rules:
        - 4f0d0d1c-2a5f-4a8f-9c8b-6a1f3c2f8b41
    group-by:
        - ParentImage
        - Computer
    timespan: 5m
    condition:
        gte: 3

What it catches and what it misses

It catches an operator who types. It does not catch a RAT that is installed, persists and is never used, because that produces no child processes at all. It misses implants running from C:\Windows\System32 after a privilege escalation, and it misses anything that executes discovery through in-process API calls instead of spawning net.exe. Cobalt Strike's built-in commands are the obvious example of that gap. It also misses non-Windows tradecraft entirely.

The correlation window is a tradeoff we chose, not a truth. Three events in five minutes suppresses most installer noise in our testing, and an operator who works slowly enough will slip under it.

ATT&CK mapping

Summary

A RAT is an interactive control channel, and the interactivity is the detection surface. Family-specific signatures age badly because the source for njRAT, gh0st RAT, Quasar and AsyncRAT is public and a rebuild changes every hash and string you keyed on. The behaviour does not change, because the operator still needs a shell, still runs discovery, and still parents those processes off an implant sitting in a writable directory. Write rules against the process tree and the beacon shape, keep the family signatures as a cheap second layer, and accept that your RMM tooling will generate false positives forever.

If you want to see how this fits into a wider analysis workflow, start with what malware analysis actually involves. To pull the relevant detections, browse the Windows rules or search the catalog for remote access.

Telemetry to enable before hunting RATs:
  Sysmon 1   process creation, with ParentImage and CommandLine
  Sysmon 3   network connection, with Image
  Sysmon 11  file create
  Sysmon 12  registry object create and delete
  Sysmon 13  registry value set
  Sysmon 22  DNS query
  Security 4688 with command line auditing enabled
  Security 4698 scheduled task created
  System 7045 service installed
  Zeek conn.log, dns.log, ssl.log