Windows: Detects NetSupport RAT client32.exe execution using Imphash and filename metadata

Flags renamed NetSupport RAT client32.exe launches on Windows using a specific Imphash and file metadata, while filtering a matching image path.

FreeUnreviewedSigmahighv1

windows-detects-netsupport-rat-client32-exe-execution-using-imphash-and-filename-0afbd410

title: "Windows: Detects NetSupport RAT client32.exe execution using Imphash and filename metadata"
id: d74bba66-a783-4440-8650-4afc021f1f58
status: test
description: This rule identifies execution events where process metadata indicates NetSupport Remote Control and an original file name containing client32.exe. It keys off a specific Imphash value along with Product and OriginalFileName strings, and then excludes cases where the Image path ends with \client32.exe. The behavior matters because attackers may rename or masquerade known RAT binaries to evade simpler filename-based detections; the rule relies on process creation telemetry with hash, product, original file name, and image path fields.
references:
  - https://redcanary.com/blog/misbehaving-rats/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_netsupport_rat.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-19
modified: 2024-11-23
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Product|contains: NetSupport Remote Control
    - OriginalFileName|contains: client32.exe
    - Hashes|contains: IMPHASH=A9D50692E95B79723F3E76FCF70D023E
  filter:
    Image|endswith: \client32.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0afbd410-de03-4078-8491-f132303cb67d
    type: derived

What it detects

This rule identifies execution events where process metadata indicates NetSupport Remote Control and an original file name containing client32.exe. It keys off a specific Imphash value along with Product and OriginalFileName strings, and then excludes cases where the Image path ends with \client32.exe. The behavior matters because attackers may rename or masquerade known RAT binaries to evade simpler filename-based detections; the rule relies on process creation telemetry with hash, product, original file name, and image path fields.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.