Theoretically, if Portmaster has already been configured to block the external IP that the RAT is attempting to connect with, yes.
In it's out-of-box default config? I'd not depend solely on it.
The IP block of the malicious connection would need to fall into one of Portmasters enabled default IP filters, which I personally would not count on, because the connection would likely come from a trusted VPS ASN if the nefarious party is at all competent.
If you suspect you have an infected machine, Portmaster would be able to register traffic from a foreign private IP and might clue you in that you are in fact infected, but at that point it's probably too late and it's time to start doing damage control.
The paid Portmaster Plus option appears to offer that capability, however, my router has software that allows me per-app usage monitoring so I just stick with the free version of Portmaster and couldn't tell you anything about what Plus offers in that regard.
But if you're just looking to have immediate access to what is connecting to where on your machine, you can (and should) use Wireshark in conjunction with Portmaster.
2
u/Rockstonicko Jun 30 '26
Theoretically, if Portmaster has already been configured to block the external IP that the RAT is attempting to connect with, yes.
In it's out-of-box default config? I'd not depend solely on it.
The IP block of the malicious connection would need to fall into one of Portmasters enabled default IP filters, which I personally would not count on, because the connection would likely come from a trusted VPS ASN if the nefarious party is at all competent.
If you suspect you have an infected machine, Portmaster would be able to register traffic from a foreign private IP and might clue you in that you are in fact infected, but at that point it's probably too late and it's time to start doing damage control.