RunningRAT is a remote access trojan that gives an attacker covert control of an infected system. It is used for persistence, command execution and data theft, so defenders should look for suspicious outbound connections, unexpected administrative activity and unusual process behaviour on endpoints where remote control is not expected.
What RunningRAT Is in Practice
RunningRAT is a remote access trojan, which means it is malware built to quietly give an attacker interactive control over a compromised endpoint while hiding that control from the user and normal monitoring.
Unlike commodity spyware that only steals data or disruptive ransomware that immediately announces itself, a RAT is usually designed to stay usable for the operator. That makes it a platform for repeated access, not just a one-time intrusion.
Why RunningRAT Matters to Defenders
The security significance of a RAT is that it converts one infected host into a remote foothold. Once an attacker can issue commands, browse files, or pivot through the system, the compromise can expand into persistence, lateral movement, and data theft.
Defenders should treat any unexpected administrative activity, unusual process tree, or outbound connection to an untrusted host as a signal to investigate whether the endpoint is being remotely operated rather than merely malfunctioning.
How RunningRAT Is Typically Used
RAT operators generally use covert channels to keep command-and-control traffic blended into routine network activity. That traffic may be intermittent, low volume, or disguised as legitimate application communication, which is why detection often depends on correlation across endpoint, network, and authentication telemetry.
In many incidents, the malware’s value is not a single capability but the combination of persistence and flexible tasking. An attacker can return later, run new commands, stage additional tooling, and move from reconnaissance to exfiltration without needing a new initial compromise.
What Indicators Usually Deserve Attention
Endpoint and network clues often matter more than the malware name itself. Watch for processes that spawn shell or scripting activity unexpectedly, services or scheduled tasks that appear without a clear business reason, and outbound sessions from hosts that should not be initiating remote control.
Because RATs are built to blend in, weak signals become important when they appear together. A single odd connection may be noise, but a strange process plus unusual administrative behaviour plus new persistence is a much stronger compromise pattern.
Risk and Threat Considerations
RATs are dangerous because they give an attacker durable interactive access, not just a static payload. That creates a direct pathway from initial compromise to command execution, data theft, and follow-on tooling, often before defenders realise the host is under remote control.
Failure mechanism: The malware hides command-and-control traffic and piggybacks on legitimate-looking processes or network flows, allowing the attacker to keep issuing commands while avoiding simple signature-based detection.
Impact: A compromised endpoint can become an operator-controlled beachhead for persistence, credential exposure, internal reconnaissance, and staged exfiltration.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1021 — Remote Services | RAT activity often uses remote-control paths to maintain interactive access. |
| T1059 — Command and Scripting Interpreter | RATs commonly execute attacker commands through shell or scripting interpreters. | |
| T1105 — Ingress Tool Transfer | RAT operators frequently stage additional tools after establishing control. | |
| Recommendation — Map unexpected remote administration to T1021 and verify whether the session is authorised. Correlate suspicious interpreter activity with possible RAT tasking and isolate the host. Hunt for follow-on tool delivery when you detect RAT-style command activity. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | RAT detection depends on reviewing endpoint and network audit evidence for anomalous behaviour. |
| SI-4 — System Monitoring | RATs are commonly found through monitoring of anomalous endpoint and network activity. | |
| AC-6 — Least Privilege | RAT impact is worse when compromised endpoints can execute privileged actions freely. | |
| Recommendation — Review audit records for unusual process, remote access, and outbound connection patterns. Monitor endpoints and traffic for covert command-and-control indicators and unexpected administration. Restrict administrative paths so a compromised host cannot easily escalate or persist. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Log review is central to finding unusual remote control, persistence and execution behaviour. |
| CIS-10 — Malware Defenses | RATs are malware, so malware prevention and detection controls directly apply. | |
| Recommendation — Centralise and review logs to spot RAT-related process and connection anomalies. Use malware defenses to block, detect, and contain remote access trojans. | ||
Practitioner Guidance
What to watch for: Investigate any endpoint that shows unexplained remote administration behaviour, abnormal child processes, or persistent outbound connectivity to destinations that do not fit the host’s role. Those patterns often matter more than the malware family name alone.
Governance implication: Treat RAT detection as an endpoint and network visibility problem, not only a malware-cleanup problem. If your telemetry cannot distinguish expected remote administration from covert control, you will struggle to confirm eradication.