Windows: NetSupport Manager Client32 Service Installation via Service Control Manager (Event ID 7045)

Flags Windows service creation for NetSupport Manager Client32 (client32.exe) using Service Control Manager Event ID 7045.

FreeUnreviewedSigmamediumv1

windows-netsupport-manager-client32-service-installation-via-service-control-man-2d510d8d

title: "Windows: NetSupport Manager Client32 Service Installation via Service Control Manager (Event ID 7045)"
id: bff37c37-321a-47d5-8011-c52f2dc3ce12
status: test
description: This rule identifies installation of a Windows service named Client32 with an ImagePath pointing to NetSupport Manager\client32.exe. Attackers may use legitimate remote management tooling to establish persistence by registering services that start automatically or run under privileged accounts. The detection relies on Windows Service Control Manager telemetry (Event ID 7045) and checks the configured service name and executable path.
references:
  - http://resources.netsupportsoftware.com/resources/manualpdfs/nsm_manual_uk.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_netsupport_manager.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-31
tags:
  - attack.persistence
logsource:
  product: windows
  service: system
detection:
  selection_root:
    Provider_Name: Service Control Manager
    EventID: 7045
  selection_service:
    - ImagePath|contains: \NetSupport Manager\client32.exe
    - ServiceName: Client32
  condition: all of selection_*
falsepositives:
  - Legitimate use of the tool
level: medium
license: DRL-1.1
related:
  - id: 2d510d8d-912b-45c5-b1df-36faa3d8c3f4
    type: derived

What it detects

This rule identifies installation of a Windows service named Client32 with an ImagePath pointing to NetSupport Manager\client32.exe. Attackers may use legitimate remote management tooling to establish persistence by registering services that start automatically or run under privileged accounts. The detection relies on Windows Service Control Manager telemetry (Event ID 7045) and checks the configured service name and executable path.

Known false positives

Legitimate use of the tool

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.