HACKING PROJECT · network · Advanced
Python Remote Access Trojan (RAT)
Build a modular Python RAT with encrypted C2 in an isolated lab and produce the corresponding detection and defensive artifacts.
RATs remain a staple of espionage and commodity crime, providing remote command execution, surveillance, and exfiltration over covert channels. Defenders and malware analysts who have never built one struggle to anticipate C2 behavior, beaconing patterns, and evasion, weakening their detection engineering. A controlled, educational RAT build closes this offensive-understanding-to-defense gap.
**What you'll build**
Build a Python RAT for an isolated lab: an agent that connects back to a controller over an encrypted channel and supports remote command execution, file transfer, screenshot, and keylogging modules, plus a management server. Instrument it with a mandatory kill-switch and lab-scoping, then derive detection artifacts (network signatures, Sigma rules, host IOCs) and a defensive write-up. The emphasis is on understanding C2 mechanics to build better detections — never deployment against non-consenting systems.
**Objective** — Build a modular Python RAT with encrypted C2 in an isolated lab and produce the corresponding detection and defensive artifacts.
**Expected outcome** — A functioning lab RAT (agent + controller) with several capability modules, encrypted C2, a kill-switch, and a detection pack (Sigma/network IOCs) plus analysis report.
**Difficulty** — Advanced — covers socket C2, encryption, modular commands, and evasion, but Python lowers the systems barrier vs. project 16.
**Primary category** — Malware Development & C2 (educational); Secondary = Adversary Emulation, Detection Engineering
**Security domains** — Primary = Red Team; Secondary = Malware Analysis, Blue Team, Purple Team, Security Research
**Technical focus** — client-server C2, encrypted communications, remote command execution, file exfiltration, screen capture, keylogging, beaconing/jitter, persistence hooks, kill-switch/lab safety, Sigma/network signature authoring
**Core technologies** — Languages: Python, some PowerShell/Bash for staging; Frameworks/Libraries: sockets/asyncio, cryptography/PyNaCl, pynput, Pillow, PyInstaller; Security Tools: Wireshark, Sigma, Suricata, YARA, sandbox (Cuckoo/any.run-style); Cloud/Infra: isolated VM range, redirectors, Docker; AI/Data: optional beacon-pattern analysis; Databases: SQLite for session/task store
**Where it's valued** — Red-team consultancies, AV/EDR vendors, malware research labs, national CERTs, security training providers
**Careers it builds toward** — Red Team Operator, Malware Analyst, Detection Engineer, Threat Emulation Engineer, Offensive Security Researcher
**Framework alignment**
• MITRE ATT&CK: Command and Control — Remote Access Software (T1219), Application Layer Protocol (T1071), Encrypted Channel (T1573), Ingress Tool Transfer (T1105); Collection — Screen Capture (T1113), Input Capture: Keylogging (T1056.001); Exfiltration — Exfiltration Over C2 Channel (T1041); Persistence — Boot/Logon Autostart (T1547)
• NIST CSF 2.0: Detect (via emulation-driven detection engineering) and Identify; supports Respond through C2 IOC development
• OWASP: N/A (not a web app); controller web UI, if built, inherits Web Top 10 concerns
• CIS Controls v8: 10 (Malware Defenses), 13 (Network Monitoring & Defense), 8 (Audit Log Management), 18 (Penetration Testing)
**Innovation** — Existing Idea / Improved Existing Solution — Python RATs are common teaching artifacts; the value-add is encrypted modular C2 paired with detection engineering and strict safety controls. Scores: Innovation 5/10, Startup 4/10, Enterprise-Readiness 5/10, Patent = No.