Windows Process Creation: NetSupport Client Configurator (PCICFGUI.EXE)

title: "Windows Process Creation: NetSupport Client Configurator (PCICFGUI.EXE)"
id: acea914e-c4eb-403e-a5ab-390fc777281e
status: test
description: This rule flags Windows process creation events for NetSupport Remote Control software by matching NetSupport-specific product, company, and the executable PCICFGUI.EXE (NetSupport Client Configurator). Attackers can misuse remote control tooling to establish interactive access within target environments, blending in with legitimate administrative or support software. It relies on process creation telemetry including process name and metadata fields such as Product, Company, Description, and OriginalFileName.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_netsupport.yml
author: frack113, Huntrule Team
date: 2022-09-25
modified: 2023-03-06
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Description: NetSupport Client Configurator
    - Product: NetSupport Remote Control
    - Company: NetSupport Ltd
    - OriginalFileName: PCICFGUI.EXE
  condition: selection
falsepositives:
  - Legitimate use
level: medium
license: DRL-1.1
related:
  - id: 758ff488-18d5-4cbe-8ec4-02b6285a434f
    type: derived