All Detections

Renamed NetSupport RAT Execution

avatar
SigmaHQ Detections@sigmaHQ
updated Apr 28, 2026000

Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings

Sigma