Windows: NetSupport client32.exe Executed From Non-Standard Directory

title: "Windows: NetSupport client32.exe Executed From Non-Standard Directory"
id: a2d72a35-a71f-488f-b4c5-1222d58114e4
status: test
description: Identifies process creation where the executable name ends with client32.exe and related metadata indicates NetSupport Remote Control. The rule only fires when the file is launched from a location other than standard Program Files directories, which can help flag persistence or operator tooling running from unexpected paths. It relies on Windows process creation telemetry, including Image path, file metadata fields, and a specific IMPHASH value.
references:
  - https://redcanary.com/blog/misbehaving-rats/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_netsupport_susp_exec.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-19
modified: 2024-11-23
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \client32.exe
    - Product|contains: NetSupport Remote Control
    - OriginalFileName|contains: client32.exe
    - Hashes|contains: IMPHASH=a9d50692e95b79723f3e76fcf70d023e
  filter:
    Image|startswith:
      - C:\Program Files\
      - C:\Program Files (x86)\
  condition: selection and not filter
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 37e8d358-6408-4853-82f4-98333fca7014
    type: derived