# Execution of Remote Access Tool

## Summary
After gaining initial access, the adversaries executed a Remote Access Tool (RAT) on compromised systems. This RAT allows them to remotely control the infected machines and facilitates further exploitation.

## Details
- **RAT Capabilities**: File transfer, command execution, and keylogging.
- **Persistence**: The RAT is configured to start at system boot, ensuring continuous access.
- **Communication**: The tool communicates with command and control (C2) servers using encrypted channels to evade detection.

## Next Steps
Deployment of a rootkit is anticipated to establish deeper persistence and stealth, likely the next phase in the attack.

## Recommendations
- Monitor network traffic for anomalous connections to known or suspected C2 domains.
- Conduct thorough endpoint scans to identify and neutralize the RAT.