CastleLoader/NetSupport RAT Staging via Browser or Mail Client Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects when common web browsers or messaging applications spawn suspicious child processes such as command-line interpreters (cmd, powershell, wscript, mshta) or processes associated with remote access tools (NetSupport Manager). Such behaviors are often indicative of exploitation, malicious payload delivery, or unauthorized remote access.