# What is a Remote Access Trojan (RAT)?

> A remote access trojan (RAT) is malware that gives a remote operator unauthorized control of a device while concealing or misrepresenting its purpose.

- Canonical URL: https://yellowcube.eu/glossary/remote-access-trojan/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Depending on its capabilities and privileges, a RAT may execute commands, transfer files, capture screens or input, activate device sensors, change settings, or install additional components without the device owner’s informed permission.

RATs commonly initiate an outbound connection or poll command-and-control infrastructure to receive tasks through restrictive networks. They may establish persistence and collect information before an operator interacts. Capabilities matter more than a family name.

### Key points

- **Entry and persistence:** RATs may arrive through a Trojanized program, malicious document, compromised account, exploit, or another malware component, then use operating-system or application mechanisms to restart.
- **Investigation:** Correlate installation events, unusual parent processes, persistence changes, interactive commands, file movement, sensor access, and external communications with asset ownership and approved support activity.
- **Response:** Isolate and preserve affected systems according to the incident plan, revoke exposed credentials and sessions, identify the entry path and related hosts, and rebuild when integrity cannot be established.
- **Important limitation:** A RAT does not necessarily provide every form of “total control,” and encryption or remote-control traffic alone is not evidence of malware. Detection can also miss dormant access, alternate channels, or commands carried through legitimate services.

### Related terms

[Trojan horse](<https://yellowcube.eu/glossary/trojan-horse/>) · [Malware](<https://yellowcube.eu/glossary/malware/>) · [Command and control (C2)](<https://yellowcube.eu/glossary/command-and-control/>) · [Secure remote access](<https://yellowcube.eu/glossary/secure-remote-access/>) · [Endpoint detection and response (EDR)](<https://yellowcube.eu/glossary/endpoint-detection-and-response/>) · [Backdoor](<https://yellowcube.eu/glossary/backdoor/>) · [Persistence](<https://yellowcube.eu/glossary/persistence/>)

### Sources

[CISA Continuous Diagnostics and Mitigation Data Model v5.0.1](https://www.cisa.gov/sites/default/files/2024-12/CDM%20Data%20Model%20Document%20V5.0.1%20Public%20Release508.pdf) · [MITRE ATT&CK T1219: Remote Access Tools](https://attack.mitre.org/techniques/T1219/) · [Europol: Cyber-attacks and malware types](https://www.europol.europa.eu/crime-areas/cyber-attacks)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.