Remote Access Trojans (RATs) are a class of malware that is designed to gain persistent access to the target computer system, and by leveraging elevation of privilege vulnerabilities gain administrator rights over the device and so take full control of the system and all the data on it.
This may sound sophisticated, but the delivery system is actually relatively simple and Security Managers can take some basic steps to harden their network against RATDispenser and similar malware.
Defend against RATDispenser
Security Managers can defend against RATDispenser and similar malware in two ways:
- Block executable email attachments
- Limit the running of scripts to require digitally signed scripts or block them all together.
Blocking executable email attachments can be done by following this guidance for Microsoft Exchange. Firewalls and security appliances may also have the ability to inspect incoming email and filter out malicious attachments.
If a malicious attachment does manage to get delivered to an end user, and despite their Security Awareness Training they still click on the attachment to open it, then disabling or limiting the execution of scripts will provide an additional layer of defence.
Windows Script Host can be fully disabled by adding a registry entry. However, there may be legitimate use of Windows Scripting for system administration in which case it is possible to configure a Windows system to only allow digitally signed scripts to execute.
Note that if you have not configured Software Restriction Policies for your domain, you will first need to disable them by setting the registry for Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings\useWINSAFER to 0 and then you can set TrustPolicy to 2 (2 = only allow signed scripts or set it to 1 to always ask before running a script if it is not signed).