# What is a remote-access trojan (RAT)?

A remote-access trojan is malware that gives an attacker full control of a computer: they can see the screen, log keystrokes, open files, switch on the camera, run commands and use the machine as a stepping stone into the network. It usually arrives through phishing attachments, fake software downloads or cracked programs, and it keeps a connection to its operator, either open all the time or by checking in at intervals. On the computer, endpoint protection and application control are the main defences. On the network, the connection to the operator is the most reliable sign: small, regular traffic to an unfamiliar destination, often over HTTPS or an unusual port, sometimes relayed through a legitimate cloud service. NetSenX flags this beaconing on every plan, and from the Starter plan compares TLS handshakes with fingerprints of known malware where the agent captures packets, on Linux or as a SPAN/TAP sensor.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-a-remote-access-trojan

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is an initial access broker?](https://netsenx.com/en/faq/what-is-an-initial-access-broker)
- [What is a web shell?](https://netsenx.com/en/faq/what-is-a-web-shell)
- [What is protocol tunnelling?](https://netsenx.com/en/faq/what-is-protocol-tunnelling)
- [Why do attackers use legitimate remote-access tools?](https://netsenx.com/en/faq/why-do-attackers-use-legitimate-remote-access-tools)
- [What is wiper malware?](https://netsenx.com/en/faq/what-is-wiper-malware)