NetSupport Manager Execution from an Unusual Path

About

Tags

Domain: EndpointOS: WindowsUse Case: Threat DetectionTactic: Command and ControlData Source: Elastic EndgameData Source: Elastic DefendData Source: SysmonData Source: SentinelOneData Source: Microsoft Defender for EndpointData Source: Windows Security Event LogsData Source: CrowdstrikeLanguage: eql

Severity

high

Risk Score

73

MITRE ATT&CK™

Command and Control (TA0011)(opens in a new tab or window)

↳ Remote Access Tools (T1219)(opens in a new tab or window)

License

Elastic License v2(opens in a new tab or window)

Definition

Rule Type

Event Correlation Rule

Integration Pack

Prebuilt Security Detection Rules

Index Patterns

endgame-*logs-crowdstrike.fdr*logs-endpoint.events.process-*logs-m365_defender.event-*logs-sentinel_one_cloud_funnel.*logs-system.security*logs-windows.sysmon_operational-*winlogbeat-*

Related Integrations

endpoint(opens in a new tab or window)

windows(opens in a new tab or window)

sentinel_one_cloud_funnel(opens in a new tab or window)

m365_defender(opens in a new tab or window)

system(opens in a new tab or window)

crowdstrike(opens in a new tab or window)

Query

process where host.os.type == "windows" and event.type == "start" and
 (process.name : "client32.exe" or ?process.pe.original_file_name == "client32.exe" or process.parent.name : "client32.exe") and
 (
  process.executable :
               ("?:\\Users\\*.exe",
                "?:\\ProgramData\\*.exe",
                "\\Device\\HarddiskVolume?\\Users\\*.exe",
                "\\Device\\HarddiskVolume?\\ProgramData\\*.exe") or
  ?process.parent.executable : ("?:\\Users\\*\\client32.exe", "?:\\ProgramData\\*\\client32.exe")
  )