NetSupport Client Configurator Execution

SigmaHQ Detections@sigmaHQ

•updated Jun 13, 2025•0•16

This rule detects the execution of NetSupport Client Configurator (PCICFGUI.EXE) based on its description, product name, company, and original filename. NetSupport is a legitimate remote access tool that can be abused by adversaries to establish command and control, as highlighted by the MITRE ATT&CK framework.