Windows: NetSupport client32.exe Executed From Non-Standard Directory
Flags NetSupport client32.exe launched from locations outside Program Files on Windows.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-19
- Updated
- 2026-07-30
What it detects
Identifies process creation where the executable name ends with client32.exe and related metadata indicates NetSupport Remote Control. The rule only fires when the file is launched from a location other than standard Program Files directories, which can help flag persistence or operator tooling running from unexpected paths. It relies on Windows process creation telemetry, including Image path, file metadata fields, and a specific IMPHASH value.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-netsupport-client32-exe-executed-from-non-standard-directory-37e8d358
title: "Windows: NetSupport client32.exe Executed From Non-Standard Directory"
id: a2d72a35-a71f-488f-b4c5-1222d58114e4
status: test
description: Identifies process creation where the executable name ends with client32.exe and related metadata indicates NetSupport Remote Control. The rule only fires when the file is launched from a location other than standard Program Files directories, which can help flag persistence or operator tooling running from unexpected paths. It relies on Windows process creation telemetry, including Image path, file metadata fields, and a specific IMPHASH value.
references:
- https://redcanary.com/blog/misbehaving-rats/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_netsupport_susp_exec.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-19
modified: 2024-11-23
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \client32.exe
- Product|contains: NetSupport Remote Control
- OriginalFileName|contains: client32.exe
- Hashes|contains: IMPHASH=a9d50692e95b79723f3e76fcf70d023e
filter:
Image|startswith:
- C:\Program Files\
- C:\Program Files (x86)\
condition: selection and not filter
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 37e8d358-6408-4853-82f4-98333fca7014
type: derived