NetSupport RAT client32.exe Execution Spawned from Browser or PowerShell

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects the execution of the NetSupport Manager remote access tool (client32.exe) when spawned by web browsers or script interpreters such as PowerShell or MSHTA. This behavioral pattern is frequently associated with malicious delivery chains including ClickFix and CastleLoader, where users are social engineered into downloading or executing suspicious payloads.