Renamed NetSupport RAT Execution

SigmaHQ Detections@sigmaHQ

•updated Nov 25, 2024•0•16

This rule detects the execution of NetSupport RAT, specifically looking for instances where the 'client32.exe' component has been renamed. It identifies the RAT by checking for specific product strings ('NetSupport Remote Control'), original file names ('client32.exe'), or a known Imphash (A9D50692E95B79723F3E76FCF70D023E). The rule explicitly excludes legitimate executions of 'client32.exe' to focus on renamed instances, indicating an attempt at defense evasion.