Windows Process Creation: NetSupport Client Configurator (PCICFGUI.EXE)
Alerts on execution of NetSupport Client Configurator (PCICFGUI.EXE) on Windows via process metadata.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-09-25
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows process creation events for NetSupport Remote Control software by matching NetSupport-specific product, company, and the executable PCICFGUI.EXE (NetSupport Client Configurator). Attackers can misuse remote control tooling to establish interactive access within target environments, blending in with legitimate administrative or support software. It relies on process creation telemetry including process name and metadata fields such as Product, Company, Description, and OriginalFileName.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: NetSupport Client Configurator (PCICFGUI.EXE)"
id: acea914e-c4eb-403e-a5ab-390fc777281e
status: test
description: This rule flags Windows process creation events for NetSupport Remote Control software by matching NetSupport-specific product, company, and the executable PCICFGUI.EXE (NetSupport Client Configurator). Attackers can misuse remote control tooling to establish interactive access within target environments, blending in with legitimate administrative or support software. It relies on process creation telemetry including process name and metadata fields such as Product, Company, Description, and OriginalFileName.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_netsupport.yml
author: frack113, Huntrule Team
date: 2022-09-25
modified: 2023-03-06
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
category: process_creation
product: windows
detection:
selection:
- Description: NetSupport Client Configurator
- Product: NetSupport Remote Control
- Company: NetSupport Ltd
- OriginalFileName: PCICFGUI.EXE
condition: selection
falsepositives:
- Legitimate use
level: medium
license: DRL-1.1
related:
- id: 758ff488-18d5-4cbe-8ec4-02b6285a434f
type: derived