PowerShell downloads fake MP4 via web cmdlets then NetSupport client runs

ills3c Intel&Coffee@Ills3C

•updated 7 days ago•4•0•8

Detects a sequence where PowerShell or PWSH executes a web download referencing an .mp4 file using download cmdlets, followed within 1 hour by the execution of NetSupport Manager components (client32.exe or pcictlui.exe) from a user-writable path.