Windows Service Installation via NetSupport Manager (Event ID 7045)
Flags Windows service creation for NetSupport Manager Client32 (client32.exe) using Service Control Manager Event ID 7045.
- Product
- windows
- Service
- system
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-31
- Updated
- 2026-07-31
What it detects
This rule identifies creation of a Windows service by Service Control Manager (Event ID 7045) where the new service references NetSupport Manager's client32.exe in its ImagePath and uses the ServiceName Client32. Service installation is a common persistence technique because it enables code to start automatically and remain available across reboots. The detection relies on Windows service installation telemetry from Event ID 7045, specifically ImagePath and ServiceName values.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Service Installation via NetSupport Manager (Event ID 7045)
id: bff37c37-321a-47d5-8011-c52f2dc3ce12
status: test
description: This rule identifies creation of a Windows service by Service Control Manager (Event ID 7045) where the new service references NetSupport Manager's client32.exe in its ImagePath and uses the ServiceName Client32. Service installation is a common persistence technique because it enables code to start automatically and remain available across reboots. The detection relies on Windows service installation telemetry from Event ID 7045, specifically ImagePath and ServiceName values.
references:
- http://resources.netsupportsoftware.com/resources/manualpdfs/nsm_manual_uk.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_netsupport_manager.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-31
tags:
- attack.persistence
logsource:
product: windows
service: system
detection:
selection_root:
Provider_Name: Service Control Manager
EventID: 7045
selection_service:
- ImagePath|contains: \NetSupport Manager\client32.exe
- ServiceName: Client32
condition: all of selection_*
falsepositives:
- Legitimate use of the tool
level: medium
license: DRL-1.1
related:
- id: 2d510d8d-912b-45c5-b1df-36faa3d8c3f4
type: derived