A remote access trojan, or RAT, is software that gives an attacker interactive control of a computer from far away. Many attackers now skip custom malware and use legitimate remote support tools. Detection therefore depends on knowing which remote tools you approved, and alerting on every other one.
What does the attacker get?
MITRE ATT&CK tracks this as Remote Access Tools, technique T1219 in the Command and Control tactic. It says adversaries may use legitimate remote access tools to establish an interactive command and control channel within a network. Those tools create a session between two trusted hosts through a graphical interface, a command line, a tunnel via development or management software, or hardware level access such as KVM over IP.
The user's rights carry over: the tool lets the operator control a computer as if they were a local user, inheriting the permissions of the user or software. Installation of many tools also includes persistence, for example a Windows service created by the installer.
As of the version fetched, T1219 lists three sub-techniques: IDE Tunneling, Remote Desktop Software and Remote Access Hardware. MITRE also notes that attackers may abuse remote access features built into defensive tools, and that remote access features can exist inside otherwise ordinary software, such as a browser's remote desktop feature.
Why is it hard to spot?
Because the software is legitimate. The procedure examples on the ATT&CK page include groups using commercial remote administration and support tools to keep access to victim environments. The binary is signed and may even be on your approved list somewhere else in the company. What gives it away is context: where it was installed, by whom, when and from what source.
Constructed example: a help desk uses one remote support product. A finance workstation starts running a different one, installed from a user's downloads folder two days after a convincing "invoice" email. The tool is genuine and the traffic goes to a normal looking domain. Only the inventory shows it does not belong.
How do you detect one?
- Keep a list of approved remote access tools, with the owners who use them.
- Alert on installation or first execution of any remote tool outside the list. Endpoint tools and software inventory can report this.
- Watch for new services and scheduled tasks created around the same time as a new tool, since installers often add persistence.
- Look at network egress. Unusual long lived outbound connections from a workstation, and traffic to remote support domains from machines that never use them, are leads.
- Monitor remote desktop and tunnel use from servers, which rarely need interactive outbound sessions.
- Review after any phishing report: find what else ran on the machine in the following hours.
How do you reduce the risk?
- Application control that allows only approved software to run, so an unapproved remote tool will not start.
- Egress filtering so servers and sensitive workstations can reach only the destinations they need.
- Least privilege. A remote session inherits the user's rights, so ordinary users should not be local administrators.
- Multifactor authentication on every legitimate remote tool you do approve.
- User training on unsolicited calls and messages asking to install "support" software. CISA's phishing guidance lists unsolicited attachments and requests that create urgency among common indicators.
What do you do if you find one?
Isolate the machine from the network but do not power it off if you may need memory evidence. Identify when the tool first appeared, what the operator did, and which accounts were used on that machine. Reset those credentials from a clean device, and look for the same tool on other hosts. Then close the entry route, whether that was phishing, an exposed service or an unmanaged laptop.
Quick check
Is a remote access tool always malware?
No. Legitimate remote support software is widely used. It becomes a RAT in practice when someone uses it without authorization to control a machine, which is why an approved list matters.
What is the best single detection?
Alert when a remote access tool runs that is not on your approved list. It catches both custom malware families and legitimate tools used by attackers.
Sources
Last reviewed: 18 October 2026.
