NetSupport Manager C2 beacon to paternal-angrily.com gateway

Ibrahim Saud@tektrix

•updated 15 days ago•0•0•3

Detects network activity associated with NetSupport Manager remote access software, specifically targeting DNS lookups, TLS SNI connections, and direct TCP beaconing to a known-malicious infrastructure IP. This rule is designed to identify unauthorized use of legitimate remote support tools for command and control purposes.