NetSupport client32/pcictlui executing from user-writable paths

ills3c Intel&Coffee@Ills3C

•updated 7 days ago•3•0•7

Detects the execution of NetSupport Manager client binaries (client32.exe or pcictlui.exe) from user-writable directories such as AppData, ProgramData, or Public folders, optionally spawned by script loaders or command interpreters.