SocGholish - NetSupport RAT PowerShell Staging (T1105)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•3•0•7

Detects the secondary PowerShell stage explicitly downloading and writing the client32.exe NetSupport Manager RAT binary to disk. This rule identifies instances where a file named 'client32.exe' is created on a device, and the process responsible for this file creation is PowerShell.