NetSupport Manager RAT Installed as Secondary Payload Post-Infection
This rule detects the execution of NetSupport Manager related files, specifically 'client32.exe', or the presence of 'NetSupport' or 'Manager.zip' in command lines. NetSupport is a legitimate remote administration tool that is frequently abused by adversaries to maintain persistence and remote control over compromised hosts.
CQL
