Windows: Detects NetSupport RAT client32.exe execution using Imphash and filename metadata
Flags renamed NetSupport RAT client32.exe launches on Windows using a specific Imphash and file metadata, while filtering a matching image path.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-19
- Updated
- 2026-07-30
What it detects
This rule identifies execution events where process metadata indicates NetSupport Remote Control and an original file name containing client32.exe. It keys off a specific Imphash value along with Product and OriginalFileName strings, and then excludes cases where the Image path ends with \client32.exe. The behavior matters because attackers may rename or masquerade known RAT binaries to evade simpler filename-based detections; the rule relies on process creation telemetry with hash, product, original file name, and image path fields.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detects NetSupport RAT client32.exe execution using Imphash and filename metadata"
id: d74bba66-a783-4440-8650-4afc021f1f58
status: test
description: This rule identifies execution events where process metadata indicates NetSupport Remote Control and an original file name containing client32.exe. It keys off a specific Imphash value along with Product and OriginalFileName strings, and then excludes cases where the Image path ends with \client32.exe. The behavior matters because attackers may rename or masquerade known RAT binaries to evade simpler filename-based detections; the rule relies on process creation telemetry with hash, product, original file name, and image path fields.
references:
- https://redcanary.com/blog/misbehaving-rats/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_netsupport_rat.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-19
modified: 2024-11-23
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
- Product|contains: NetSupport Remote Control
- OriginalFileName|contains: client32.exe
- Hashes|contains: IMPHASH=A9D50692E95B79723F3E76FCF70D023E
filter:
Image|endswith: \client32.exe
condition: selection and not filter
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 0afbd410-de03-4078-8491-f132303cb67d
type: derived