NetSupport Manager Multi-Mechanism Persistence Installation

Ibrahim Saud@tektrix

•updated 23 days ago•0•0•2

This rule detects various persistence mechanisms associated with the NetSupport Manager remote access tool. It monitors for the creation of services, scheduled tasks, registry modifications (such as Run keys, Winlogon Notify packages, and keyboard filter drivers), and process executions related to NetSupport Manager (specifically client32.exe).