What is a Trojan?
A Trojan is malware that impersonates a useful file, application or process component. Its name comes from the Trojan horse: the user admits an apparently safe object into the environment. File size and icon do not determine the risk; the code, behaviour and source do.
Loader or downloader
The first module runs on the device and then downloads the main malicious code or additional tools.
Detecting RAT activity
A remote access Trojan (RAT) lets an attacker execute commands, transfer files and retain control of a device. SOC monitoring and SIEM event analysis help detect this activity and route alerts to the response team.
Information theft
Targets may include passwords, browser sessions, email, documents, customer data or access keys.
NIST SP 800-83 - malware prevention and handling
The official NIST guide covers malware prevention, response preparation, detection and incident handling.
How a Trojan enters a company
A common element is the appearance of legitimacy or abuse of a trusted channel. An email filter alone is not enough when a user downloads a file from a messaging app, fake website, private cloud or compromised supplier account.
- An attachment or link in a phishing message impersonating an invoice, document, CV or notification.
- A fake installer, crack, browser extension, update or program downloaded outside a trusted distribution channel.
- A messaging app, shared drive, USB device or active-content document that asks the user to bypass controls.
- A compromised partner or administrator account sending a file from a valid mailbox and familiar conversation history.
- An exploited application or device vulnerability that deploys the Trojan without a deliberate user click.
What a Trojan does after execution
Behaviour depends on the campaign. A Trojan may establish persistence, meaning access that survives a restart, contact a command-and-control (C2) server, steal credentials, disable protection or prepare a ransomware deployment. Analysis must therefore go beyond deleting a single file.
- It starts processes, scheduled tasks, services or startup entries that survive a restart.
- It connects to a C2 domain or address, downloads commands and sends device information.
- It reads passwords, cookies, session tokens, clipboard contents, files or business-application configuration.
- It attempts to escalate privileges, disable antivirus, add an exclusion or abuse a saved administrator account.
- It scans networks and access paths to find servers, shares, backups and other devices.
Signals that need initial assessment
One symptom does not prove infection, but a group of anomalies should trigger the procedure. The best context combines EDR telemetry with email, firewall, DNS, account and ticketing-system logs.
Unusual process or connection
A program launches system tools, creates persistence or contacts a new domain immediately after a file is opened.
Account or permission change
Unusual sign-ins, an MFA reset, new mailbox rules or activity outside the user's normal profile appear.
Alerts from several sources
EDR, DNS, firewall and Microsoft 365 point to a shared timeline or the same asset.
MITRE ATT&CK - malicious file
MITRE documents user execution of malicious files and related detection and mitigation techniques.
Safe response after detecting a Trojan
Do not click further prompts or remove traces at random. Isolate the device according to risk and procedure, preserve telemetry and investigate scope. Promptly contain confirmed or credibly suspected compromised access: block the affected account, revoke sessions and tokens, and rotate passwords and keys from a clean device. Select actions for the service and business impact; do not wait for a complete review of all data.
- Confirm the alert, user, device, execution time and initiating file or process.
- Isolate the endpoint but preserve it for analysis; do not format it or delete logs before collecting evidence.
- Collect EDR telemetry and email, proxy, DNS, firewall, VPN, account and corporate-resource access logs.
- Block indicators, tokens and sessions, then change exposed passwords and keys from a trusted device.
- Check other endpoints, shares, privileged accounts and backups for similar activity.
- Before reconnecting, remove or isolate the entry route and persistence. Rebuild from a trusted source, verify safeguards and monitor for recurrence; closure requires verified remediation and a report.
Reducing the risk of another infection
Protection requires several cooperating safeguards. Endpoint detection and response (EDR) detects suspicious activity on computers and servers and supports response; antivirus identifies malware. Email controls reduce malicious delivery, multifactor authentication (MFA) limits the effect of stolen passwords, and backups support recovery. The process owner must review alerts and test the procedure regularly.
EDR for business
Process visibility, device isolation, detection rules, initial alert assessment and post-incident actions.
Email protection
Attachment and link filtering, domain protection, campaign analysis and a reporting procedure.
Backup and recovery
Segregated copies, recovery tests, RPO/RTO and a plan for ransomware or data damage.
