Remote Access Tool - NetSupport Execution From Unusual Location

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects execution of client32.exe (NetSupport RAT) from an unusual location (outside of 'C:\Program Files')