Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
NetSupport is a legitimate remote control tool, and the base of the NetSupport RAT, abused to access victim machines and deploy malware. This hunt excludes common install paths, surfacing execution from directories such as Temp or System32.
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | Intel471 |
| ID | 3f329a8c-0102-4a61-8cf3-63948aab5ef4 |
| Tactics | CommandAndControl |
| Techniques | T1219 |
| Required Connectors | SecurityEvents, WindowsSecurityEvents |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
SecurityEvent |
NewProcessName endswith "client32.exe"NewProcessName has_any "Program Files (x86)\\NetSupport" |
✓ | ✓ | ✓ |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊