NetSupport Manager — Abused Remote-Access Tool

Looks for: NetSupport client binaries executing from %ProgramData%/%AppData%/Temp. Accomplishes: the decisive RAT signal — delivery-agnostic. FP: sanctioned NetSupport in its managed path (allow-list).

// HUNT: NetSupport RAT install-path anomaly
// MITRE: T1219, T1036.005 | CONF: high  FP: low  COST: low
// TUNING: if NetSupport is sanctioned, allow-list its managed \Program Files\ path
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(client32|client32u|pcicfgui|runscript32)\.exe$/i
| ImageFileName=/\\(ProgramData|Users\\[^\\]+\\AppData|Temp)\\/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData], limit=200)

Looks for: NetSupport files (client32.ini, pcicapi.dll, HTCTL32.DLL, etc.) written to %ProgramData%/%AppData%. Accomplishes: catches the drop before execution.

// HUNT: NetSupport component files dropped to a user-writable path
// MITRE: T1219 | CONF: high  FP: low-med  COST: low
// FP NOTES: legit NetSupport installs to Program Files, not ProgramData/AppData
#event_simpleName=/PeFileWritten|NewExecutableWritten/
| TargetFileName=/\\(client32u?\.ini|pcicapi\.dll|HTCTL32\.DLL|PCICHEK\.DLL|nskbfltr\.inf|client32\.exe)$/i
| TargetFileName=/\\(ProgramData|AppData|Temp)\\/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName], limit=200)

Looks for: auto-start entries referencing a NetSupport binary in a user-writable path. Accomplishes: catches RAT persistence. FP: sanctioned managed-path NetSupport (allow-list).

// HUNT: NetSupport RAT persistence
// MITRE: T1547.001, T1053.005 | CONF: med-high  FP: low-med  COST: low
// TUNING: correlate to Q1/Q2; allow-list sanctioned managed-path NetSupport
#event_simpleName=/AsepValueUpdate|ScheduledTaskRegistered/
| (RegStringValue=/\\(ProgramData|AppData)\\.+client32|client32\.exe/i or CommandLine=/client32\.exe/i)
| table([@timestamp, ComputerName, UserName, RegObjectName, RegStringValue, CommandLine], limit=200)

Looks for: the NetSupport original-filename metadata (client32) on a process whose on-disk name differs (renamed to evade). Accomplishes: catches masquerading. FP: depends on PE-metadata telemetry availability.

// HUNT: NetSupport binary renamed (original-filename vs on-disk name mismatch)
// MITRE: T1036.005 | CONF: medium  FP: medium  COST: low
// REQUIRES: PE original-filename / internal-name telemetry (field availability varies)
// TUNING: confirm OriginalFilename is actually populated in your tenant first -- where the field is empty this returns nothing and the clean result is meaningless. If you license NetSupport, allow-list the sanctioned deployment path and signer; site-branded rollouts rename client32.exe legitimately.
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| OriginalFilename=/client32/i
| FileName!=/^client32(u)?\.exe$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, OriginalFilename, SHA256HashData], limit=200)

Looks for: client32.exe (from a user-writable path) making outbound connections. Accomplishes: surfaces gateway C2. FP: sanctioned NetSupport — correlate with Q1.

// HUNT: NetSupport gateway C2 beacon
// MITRE: T1219, T1071.001 | CONF: medium  FP: medium  COST: medium
// TUNING: correlate to Q1; exclude sanctioned NetSupport gateways
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^client32(u)?\.exe$/i
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.|127\.)/
| table([@timestamp, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=200)

Looks for: shells / recon / admin tooling parented by client32.exe. Accomplishes: catches operator hands-on-keyboard activity through the RAT. FP: low for an unsanctioned-path client.

// HUNT: Hands-on activity through NetSupport RAT
// MITRE: T1219, T1059 | CONF: high  FP: low  COST: low
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^client32(u)?\.exe$/i
| FileName=/^(cmd|powershell|pwsh|net|net1|nltest|whoami|systeminfo|reg|wmic|rundll32|mshta)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)