Netsupport RAT MSI Deployment
Detects the use of msiexec.exe to remotely download and execute an MSI package, which then spawns an encoded PowerShell command. This TTP is associated with NetSupport RAT loaders.
YARA-L
Detects the use of msiexec.exe to remotely download and execute an MSI package, which then spawns an encoded PowerShell command. This TTP is associated with NetSupport RAT loaders.
Already have an account?