NetSupport Manager client32.exe Executed from Non-Standard Path (ClickFix Chain)
Detects the execution of 'client32.exe', which is the executable for NetSupport Manager remote control software, when it is located outside of its standard installation directory. This can be indicative of a portable or unauthorized remote access tool being deployed by an adversary for persistence or command-and-control.
CQL
