Old NetSupport Manager Payload (Bloody Wolf)
Detects the presence of old versions of NetSupport Manager (client32.exe), a tool repurposed as a RAT by the Bloody Wolf threat actor. The actor is known to use versions from October 2013 or older. This rule specifically looks for 'client32.exe' with the file description 'NetSupport Client' and a FileVersion older than '12.0.0.0'.
Microsoft Sentinel (KQL)
