{
  "family": "rockrat",
  "sample_count": 1,
  "category": "trojan",
  "description": "Backdoor:Win32/Rockrat is a specific family of Remote Access Trojan (RAT) designed to provide a threat actor with complete, interactive control over a compromised Windows endpoint (`T1059`). Like many modern RATs, Rockrat is often deployed as a secondary payload after an initial breach, allowing attackers to exfiltrate data, monitor user activity, and pivot laterally across the corporate network.<br><br><b>Understanding Rockrat (Remote Access)</b><br>To an end-user, the computer functions normally, though it may occasionally feel sluggish. For a SOC analyst, a Rockrat detection is a high-severity alert indicating an active, human-driven intrusion. An attacker sitting at a remote console is using Rockrat to interact with the machine in real-time, completely bypassing standard authentication controls.<br><br><b>Execution and Control Mechanics</b><br>Once deployed, Rockrat typically establishes persistence via standard Registry Run keys or hidden scheduled tasks (`T1547.001`). It then initiates a persistent, outbound connection to its Command and Control (C2) server (`T1071.001`). The RAT provides a suite of capabilities to the attacker: opening a hidden command shell (`cmd.exe`), capturing keystrokes (`T1056.001`), taking screenshots, downloading/uploading files, and sometimes activating the webcam or microphone.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of confidentiality and integrity for the compromised host. Host-based IoCs include unknown executables running from `%AppData%` or `%Temp%` making continuous outbound network connections. EDR logs may show Rockrat spawning `cmd.exe` to execute administrative commands (like `net user` or `ping`) or reading sensitive files. Network IoCs are characterized by long-lived TCP sessions with beaconing behavior to suspicious IP addresses or dynamic DNS domains.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Rockrat and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rockrat is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Rockrat establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rockrat typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Rockrat compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Rockrat should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Rockrat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rockrat frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Rockrat across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Rockrat by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1056.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell (Providing the attacker with an interactive shell)",
      "tactic": "Execution"
    },
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging (Stealing credentials as they are typed)",
      "tactic": "Credential Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution (Ensuring the RAT survives reboots)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to sever the attacker's interactive connection and prevent data exfiltration.",
    "Analyze EDR and command-line logs to determine exactly what actions the attacker performed while the RAT was active (e.g., did they dump LSASS?).",
    "Identify the C2 domain/IP address the RAT was communicating with and block it at the perimeter.",
    "Assume any credentials typed on the infected machine are compromised and force a password reset."
  ],
  "what_to_avoid": [
    "Do not leave the machine on the network to 'monitor' the attacker; they can rapidly deploy ransomware if they sense they are being watched.",
    "Avoid trusting the integrity of the operating system after a RAT infection; the machine should be completely wiped and re-imaged."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}