NetSupport Client32.exe Execution From Unusual Location

SigmaHQ Detections@sigmaHQ

•updated Nov 25, 2024•0•13

Detects the execution of 'client32.exe', a component of the NetSupport Remote Control tool, when it is launched from an unusual directory outside of the standard 'C:\Program Files' or 'C:\Program Files (x86)' paths. This behavior can indicate an adversary attempting to evade detection by placing legitimate remote access tools in non-standard locations.