Monitoring Remote Access Trojan (RAT) Communications Using Wireshark and Suricata
Abstract
Remote Access Trojans (RATs) enable an attacker to establish unauthorized remote control over a compromised host and can maintain command-and-control communication that resembles ordinary network traffic. This study developed and functionally tested a network-monitoring system for observing simulated RAT communication in a controlled virtual environment. The system combined Suricata for rule-based intrusion detection, Filebeat and Elasticsearch for log collection and indexing, Kibana for alert visualisation, and Wireshark for packet-level verification. Kali Linux acted as the attacker, while Ubuntu served as the victim and monitoring host. A Metasploit msfvenom payload was delivered through an HTTP server, executed on the victim, and used to establish a reverse TCP session. Custom Suricata rules were configured for payload delivery, suspicious outbound connections, RAT command-and-control activity, heartbeat traffic, and related test events. Nine predefined functional test cases examined traffic capture, alert generation, JSON logging, event forwarding, dashboard display, and packet verification. All nine test cases passed under the tested configuration. This result represents a 100% functional test pass rate within the controlled environment; it does not represent detection accuracy, general classification performance, or operational effectiveness against other RAT families. The study demonstrates the functional feasibility of integrating open-source monitoring components for staged RAT traffic observation and provides a reproducible foundation for broader evaluation. Future work should incorporate multiple real-world RAT families, representative benign background traffic, encrypted command-and-control communications, and independently labelled observations to calculate precision, recall, F1-score, and false-positive rate. Resource consumption, processing throughput, and packet-drop rate should also be evaluated before the system is considered suitable for enterprise deployment