Detectionmediumtest
NetSupport Manager Service Install
Detects NetSupport Manager service installation on the target system.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Nasreddine Bencherchali (Nextron Systems)Created Mon Oct 312d510d8d-912b-45c5-b1df-36faa3d8c3f4windows
Log Source
Windowssystem
ProductWindows← raw: windows
Servicesystem← raw: system
Detection Logic
Detection Logic2 selectors
detection:
# Example:
# <EventData>
# <Data Name="ServiceName">Client32</Data>
# <Data Name="ImagePath">"C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe" /* *</Data>
# <Data Name="ServiceType">user mode service</Data>
# <Data Name="StartType">auto start</Data>
# <Data Name="AccountName">LocalSystem</Data>
# </EventData>
selection_root:
Provider_Name: 'Service Control Manager'
EventID: 7045
selection_service:
- ImagePath|contains: '\NetSupport Manager\client32.exe'
- ServiceName: 'Client32'
condition: all of selection_*False Positives
Legitimate use of the tool
MITRE ATT&CK
Tactics
Rule Metadata
Rule ID
2d510d8d-912b-45c5-b1df-36faa3d8c3f4
Status
test
Level
medium
Type
Detection
Created
Mon Oct 31
Path
rules/windows/builtin/system/service_control_manager/win_system_service_install_netsupport_manager.yml
Raw Tags
attack.persistence