{
  "family": "rockrat",
  "sample_count": 1,
  "category": "trojan",
  "description": "Backdoor:Win32/Rockrat is a specific family of Remote Access Trojan (RAT) designed to provide a threat actor with complete, interactive control over a compromised Windows endpoint (`T1059`). Like many modern RATs, Rockrat is often deployed as a secondary payload after an initial breach, allowing attackers to exfiltrate data, monitor user activity, and pivot laterally across the corporate network.<br><br><b>Understanding Rockrat (Remote Access)</b><br>To an end-user, the computer functions normally, though it may occasionally feel sluggish. For a SOC analyst, a Rockrat detection is a high-severity alert indicating an active, human-driven intrusion. An attacker sitting at a remote console is using Rockrat to interact with the machine in real-time, completely bypassing standard authentication controls.<br><br><b>Execution and Control Mechanics</b><br>Once deployed, Rockrat typically establishes persistence via standard Registry Run keys or hidden scheduled tasks (`T1547.001`). It then initiates a persistent, outbound connection to its Command and Control (C2) server (`T1071.001`). The RAT provides a suite of capabilities to the attacker: opening a hidden command shell (`cmd.exe`), capturing keystrokes (`T1056.001`), taking screenshots, downloading/uploading files, and sometimes activating the webcam or microphone.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of confidentiality and integrity for the compromised host. Host-based IoCs include unknown executables running from `%AppData%` or `%Temp%` making continuous outbound network connections. EDR logs may show Rockrat spawning `cmd.exe` to execute administrative commands (like `net user` or `ping`) or reading sensitive files. Network IoCs are characterized by long-lived TCP sessions with beaconing behavior to suspicious IP addresses or dynamic DNS domains.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1059.003",
    "T1056.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell (Providing the attacker with an interactive shell)",
      "tactic": "Execution"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging (Stealing credentials as they are typed)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution (Ensuring the RAT survives reboots)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to sever the attacker's interactive connection and prevent data exfiltration.",
    "Analyze EDR and command-line logs to determine exactly what actions the attacker performed while the RAT was active (e.g., did they dump LSASS?).",
    "Identify the C2 domain/IP address the RAT was communicating with and block it at the perimeter.",
    "Assume any credentials typed on the infected machine are compromised and force a password reset."
  ],
  "what_to_avoid": [
    "Do not leave the machine on the network to 'monitor' the attacker; they can rapidly deploy ransomware if they sense they are being watched.",
    "Avoid trusting the integrity of the operating system after a RAT infection; the machine should be completely wiped and re-imaged."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}