Remote access trojan (RAT)

Interactive remote control: shell, screen, files, keylogging

categoryMalwareseverityVery HighdetectabilityHighlabnot yet measured

Example: AsyncRAT, Remcos, XWorm

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1219 · Microsoft App Quick Assist Execution · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1219 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1219 -TestGuids 1aea6d15-70f1-4b4e-8b02-397b5d5ffe75 -TimeoutSeconds 120'

Queued for lab measurement — not yet detonated.

Classification

30 values: 17 reviewed, 12 imported, 1 derived. What do these mean?

Exploitability

Attack vector	Malware
Reach (CVSS)	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	Very High
Impact	AvailabilityConfidentialityIntegrity
Platform	LinuxmacOSWindows
Environment	CloudMobileOn-premises
Target asset class	EndpointServer
Kill-chain phase (tactic)	Command and Control

Detection & telemetry

Detectability	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	File CreationNetwork Connection CreationProcess CreationService CreationWindows Registry Key CreationWindows Registry Key Modification

Detection & response

Mitigated by 16

M1031 attack-mitigation
M1034 attack-mitigation
M1037 attack-mitigation
M1038 attack-mitigation
M1042 attack-mitigation
D3-APCA d3fend
D3-CSPP d3fend
D3-NTCD d3fend
D3-NTF d3fend
D3-NTSA d3fend
D3-OTF d3fend
D3-PHDURA d3fend
D3-PMAD d3fend
D3-RPA d3fend
D3-RTSD d3fend
D3-UGLPA d3fend

Detected by 53

DET0496 attack-detection-strategy
065b00ca-5d5c-4557-ac95-64a6d0b64d86 sigma
0b9ad457-2554-44c1-82c2-d56a99c42377 sigma
101a1877-2cf4-474d-abfd-7f6ac4788d1a sigma
114e7f1c-f137-48c8-8f54-3088c24ce4b9 sigma
145322e4-0fd3-486b-81ca-9addc75736d8 sigma
162ab1e4-6874-4564-853c-53ec3ab8be01 sigma
22c45af6-f590-4d44-bab3-b5b2d2a2b6d9 sigma
238527ad-3c2c-4e4f-a1f6-92fd63adb864 sigma
2cf29f11-e356-4f61-98c0-1bdb9393d6da sigma
2d367498-5112-4ae5-a06a-96e7bc33a211 sigma
2db93a3f-3249-4f73-9e68-0e77a0f8ae7e sigma
2fbbe9ff-0afc-470b-bdc0-592198339968 sigma
3ab79e90-9fab-4cdf-a7b2-6522bc742adb sigma
4bb79b62-ef12-4861-981d-2aab43fab642 sigma
4bc90587-e6ca-4b41-be0b-ed4d04e4ed0c sigma
4d07b1f4-cb00-4470-b9f8-b0191d48ff52 sigma
52753ea4-b3a0-4365-910d-36cff487b789 sigma
57bff678-25d1-4d6c-8211-8ca106d12053 sigma
5d756aee-ad3e-4306-ad95-cb1abec48de2 sigma
5fdce3ac-e7f9-4ecd-a3aa-a4d78ebbf0af sigma
6e22722b-dfb1-4508-a911-49ac840b40f8 sigma
6f6afac3-8e7a-4e4b-9588-2608ffe08f82 sigma
70761fe8-6aa2-4f80-98c1-a57049c08e66 sigma
74a2b202-73e0-4693-9a3a-9d36146d0775 sigma
758ff488-18d5-4cbe-8ec4-02b6285a434f sigma
778ba9a8-45e4-4b80-8e3e-34a419f0b85e sigma
7b582f1a-b318-4c6a-bf4e-66fe49bf55a5 sigma
7f3a9c2d-4e8b-4a7f-9d3e-5c6f8a9b2e1d sigma
87261fb2-69d0-42fe-b9de-88c6b5f65a43 sigma
88656cec-6c3b-487c-82c0-f73ebb805503 sigma
90d6bd71-dffb-4989-8d86-a827fedd6624 sigma
95e60a2b-4705-444b-b7da-ba0ea81a3ee2 sigma
9711de76-5d4f-4c50-a94f-21e4e8f8384d sigma
97233998-3838-4581-88c6-f1d19d3993fb sigma
9847f263-4a81-424f-970c-875dab15b79b sigma
9e4b7d3a-6f2c-4e9a-8d1b-3c5e7a9f2b4d sigma
aa3168fb-d594-4f93-a92d-7a9ba675b766 sigma
b1377339-fda6-477a-b455-ac0923f9ec2c sigma
b471f462-eb0d-4832-be35-28d94bdb4780 sigma
… and 13 more in the database

Tested by 15

0ae9e327-3251-465a-a53b-485d4e3f58fa atomic
19acf63b-55c4-4b6a-8552-00a8865105c8 atomic
1aea6d15-70f1-4b4e-8b02-397b5d5ffe75 atomic
1b72b3bd-72f8-4b63-a30b-84e91b9c3578 atomic
3e1858ee-3550-401c-86ec-5e70ed79295b atomic
42e51815-a6cc-4c75-b970-3f0ff54b610e atomic
4a18cc4e-416f-4966-9a9d-75731c4684c0 atomic
6b8b7391-5c0a-4f8c-baee-78d8ce0ce330 atomic
8ca3b96d-8983-4a7f-b125-fc98cc0a2aa0 atomic
b025c580-029e-4023-888d-a42710d76934 atomic
b1b8128b-c5d4-4de9-bf70-e60419274562 atomic
d03683ec-aae0-42f9-9b4c-534780e0f8e1 atomic
ecca999b-e0c8-40e8-8416-ad320b146a75 atomic
f1641ba9-919a-4323-b74f-33372333bf0e atomic
fbff3f1f-b0bf-448e-840f-7e1687affdce atomic

Attack relationships

Child: Abused legitimate remote-access tools

Framework references

Primary source: https://attack.mitre.org/techniques/T1219/
attack: T1219 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 71 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 22 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)