Unauthorized NetSupport Manager RAT Installation and Execution
Detects the execution of known NetSupport Manager remote access tool binaries from locations outside of the official installation directories. This behavior is indicative of unauthorized use or persistence of remote management software, often used as a RAT by adversaries.
Cortex XDR
