Suspicious NetSupport Manager Service Install (via system)

title: Suspicious NetSupport Manager Service Install (via system)
id: 885b1598-00a5-52b0-87ed-4edd500207bd
status: stable
description: This rule detects NetSupport Manager service installation on the target system.
references:
    - http://resources.netsupportsoftware.com/resources/manualpdfs/nsm_manual_uk.pdf
author: Huntrule Team
date: 2026-06-17
tags:
    - attack.persistence
    - attack.command-and-control
    - attack.t1543.003
    - attack.t1219
logsource:
    product: windows
    service: system
detection:
    selection_root:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
    selection_service:
        - ImagePath|contains: '\NetSupport Manager\client32.exe'
        - ServiceName: 'Client32'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium