NetSupport Manager multi-vector persistence (service, Run key, Winlogon, task, d

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•4

This rule identifies potential persistence activity on a Windows host by correlating multiple indicators such as service creation, scheduled tasks, registry run key modifications, Winlogon helper modifications, and driver loading. It specifically monitors for indicators associated with 'NetSupport' or 'client32' filenames or services. The rule triggers when two or more distinct persistence mechanisms are detected for the same host and user.