Detect MarkiRAT by looking for remote administration behaviour that appears outside sanctioned support activity. Review endpoint and network logs for unexpected command execution, persistence artefacts, and outbound connections to unfamiliar hosts. Investigate systems where user-facing applications start spawning shells, modifying startup locations, or contacting external infrastructure at regular intervals.
What to look for when MarkiRAT blends into normal support activity
MarkiRAT detection starts with behaviour, not just a signature hit. The strongest signal is a workstation or server that begins behaving like a remote administration foothold without a corresponding business reason: shell spawning from user-facing software, repeated contact with an external host, or persistence that survives reboot and logoff. Malware Guide is the most useful starting point when you need to compare those patterns with common RAT tradecraft and evasion patterns.
Look for clusters of activity rather than a single event. A benign remote support tool may create one or two of these artefacts, but malware usually leaves a chain of them: process ancestry that makes no sense, scheduled or startup-based persistence, encoded or obfuscated command lines, and outbound traffic that repeats on a cadence. If the same host also starts reaching unfamiliar infrastructure, the case becomes much stronger.
Endpoint and network signals that usually separate MarkiRAT from ordinary admin tools
Endpoint telemetry is the best place to prove whether the activity is interactive, automated, or implanted. Hunt for command interpreters launched by office software, browser processes, or other user applications; registry or startup-folder changes; new services; and lateral-looking actions that occur long after the user opened the application. Those details matter because remote administration malware often piggybacks on a legitimate process tree to hide its execution path.
Network logs should reinforce or disprove the endpoint story. Regular outbound beacons to rare destinations, connections to freshly seen domains or IPs, and traffic that persists outside support windows are all worth correlating. MITRE ATT&CK Enterprise Matrix helps analysts map those observations to execution, persistence, command and control, and credential-access behaviours so the team can hunt consistently instead of relying on one-off indicators.
For triage, compare the host’s activity against expected support workflows. If the machine is not under sanctioned remote management, the burden of proof shifts quickly toward malicious activity. If it is under sanctioned management, verify the tool chain, the operator identity, and the scheduled maintenance window before dismissing the alerts.
How to confirm suspicion without overcalling every remote-support tool
Confirmation usually comes from correlation. A single parent-child process anomaly is weaker than the same anomaly plus persistence and outbound command-and-control traffic. Likewise, a legitimate support product should be tied to known binaries, expected destinations, and documented administrative procedures. When those anchors are missing, treat the activity as a potential compromise rather than a tooling quirk.
Investigators should also look for repeated execution at startup or logon, hidden or renamed binaries, and changes that reappear after cleanup. Those are common signs that the operator is maintaining access, not just testing connectivity. If the host is part of a broader environment, check adjacent systems for the same process tree, the same destination pattern, or the same persistence mechanism, because a single MarkiRAT-style foothold often reveals broader campaign activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | MarkiRAT-style shell spawning maps to command execution behaviour. |
| T1547 — Boot or Logon Autostart Execution | Persistence artefacts in startup locations align with autostart persistence. | |
| T1105 — Ingress Tool Transfer | Outbound contact with unfamiliar hosts reflects external C2 or payload retrieval activity. | |
| Recommendation — Map suspicious shell launches to T1059 and hunt for process ancestry that should not exist. Check boot and logon persistence points for unauthorized startup entries. Correlate rare outbound connections with potential command-and-control infrastructure. | ||
| NIST CSF 2.0 | DE.CM-01 — The network is monitored to detect potential cybersecurity events | Detection of RAT activity depends on endpoint and network monitoring. |
| DE.AE-07 — Potential adverse events are analyzed to provide a better understanding of what events need to be detected | Analysing behaviour clusters helps distinguish malware from sanctioned admin activity. | |
| Recommendation — Tune monitoring to flag unusual process, persistence, and outbound-connection patterns. Analyze correlated host behaviour to separate benign administration from malicious remote access. | ||
Practitioner Guidance
What to prioritise: Correlate process creation, persistence, and outbound connections on the same host before you spend time on isolated indicators. A well-placed sequence is far more persuasive than a long list of generic malware artefacts.
What to verify: Confirm whether the affected system should ever run remote administration software, whether that tool is approved, and whether the destination infrastructure matches your sanctioned support stack. If the answer is no, treat the host as compromised until you can explain every artefact.
Common mistake: Do not clear the alert just because the behaviour resembles remote support. Remote administration malware often imitates exactly that pattern, so the decision point is whether the execution path, destination, and timing are expected in your environment.
Practitioner takeaway: The most reliable MarkiRAT hunts combine endpoint ancestry, persistence, and network beacons into one narrative, because any single clue can look benign while the full chain usually cannot.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org