Analytics Story: NetSupport RMM Tool Abuse

Updated Date: 2026-05-13 ID: 423cb98f-bd3d-4d82-925d-573897fc0d2f Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

Detection analytics for the NetSupport Remote Manager Tool primarily focus on identifying its misuse, as it's a legitimate tool often leveraged by adversaries. Endpoint detection involves flagging the client32.exe executable running from unusual directories like Downloads or ProgramData instead of its standard Program Files location. Suspicious activity also encompasses renamed binaries with the internal name "client32" communicating with netsupportsoftware.com, or unauthenticated remote control sessions. Furthermore, monitoring for PowerShell execution associated with NetSupport Manager can reveal malicious deployment. These analytics help distinguish legitimate remote support from potential unauthorized access.

Why it matters

NetSupport Manager, a legitimate remote access tool, often finds itself weaponized by adversaries, transforming into a Remote Access Trojan (RAT) for covert access. The narrative of its detection begins by understanding this duality while IT teams use it for benign support, threat actors exploit its capabilities, often via phishing or fake updates, to gain unauthorized control. The tell-tale signs emerge when this legitimate tool operates outside its normal parameters. For instance, observing client32.exe running from unusual directories like Downloads or ProgramData, rather than its secure Program Files location, immediately raises a red flag. Similarly, the presence of clear-text HTTP traffic containing CMD=ENCD commands, instead of the expected secure HTTPS, signals malicious intent. Furthermore, renamed binaries still internally identifying as "client32" communicating with netsupportsoftware.com, or unauthenticated remote control sessions, paint a clear picture of abuse. These anomalies, coupled with suspicious PowerShell execution, allow detection analytics to differentiate legitimate remote assistance from a stealthy intrusion, enabling defenders to uncover the adversary's presence

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Registry Keys Used For Persistence	Registry Run Keys / Startup Folder	TTP
Windows Executable Masquerading as Benign File Types	Masquerade File Type	Anomaly
Windows Credentials from Password Stores Deletion	Credentials from Password Stores	TTP
Windows RunMRU Registry Key or Value Deleted	Modify Registry	Anomaly
Windows Scheduled Task with Highest Privileges	Scheduled Task	TTP
Windows RMM Tool Execution	Remote Access Tools	Anomaly
Domain Controller Discovery with Nltest	Remote System Discovery	TTP
Windows Cabinet File Extraction Via Expand	Ingress Tool Transfer	TTP
Windows Credentials from Password Stores Query	Credentials from Password Stores	Anomaly
Windows NetSupport RMM DLL Loaded By Uncommon Process	Masquerading	Anomaly
Allow Inbound Traffic In Firewall Rule	Remote Desktop Protocol	TTP
Windows Modify Registry to Add or Modify Firewall Rule	Modify Registry	Anomaly
Powershell Windows Defender Exclusion Commands	Disable or Modify Tools	TTP
Suspicious Scheduled Task from Public Directory	Scheduled Task	Anomaly
Add or Set Windows Defender Exclusion	Disable or Modify Tools	TTP
Windows PowerShell FakeCAPTCHA Clipboard Execution	PowerShell, Windows Command Shell, Malicious Link	TTP
Windows File and Directory Enable ReadOnly Permissions	Windows Permissions	TTP
LOLBAS With Network Traffic	Ingress Tool Transfer, System Binary Proxy Execution, Exfiltration Over Web Service	TTP
Windows Defender Exclusion Registry Entry	Disable or Modify Tools	TTP
Windows Firewall Rule Added	Disable or Modify System Firewall	Anomaly
Windows Firewall Rule Modification	Disable or Modify System Firewall	Anomaly
Windows File and Directory Permissions Enable Inheritance	Windows Permissions	Hunting
Windows File Download Via PowerShell	PowerShell, Ingress Tool Transfer	Anomaly
Scheduled Task Deleted Or Created via CMD	Scheduled Task	Anomaly
Ntdsutil Export NTDS	NTDS	TTP
Windows Credentials from Password Stores Creation	Credentials from Password Stores	TTP
Windows RDP Connection Successful	RDP Hijacking	Hunting
Detect MSHTA Url in Command Line	Mshta	TTP
ICACLS Grant Command	File and Directory Permissions Modification	Anomaly
Windows Firewall Rule Deletion	Disable or Modify System Firewall	Anomaly
System Information Discovery Detection	System Information Discovery	TTP
Windows Modify Registry Delete Firewall Rules	Modify Registry	TTP
Disable Windows Behavior Monitoring	Disable or Modify Tools	TTP
Powershell Fileless Script Contains Base64 Encoded Content	Obfuscated Files or Information, PowerShell	TTP

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 29	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon EventID 12	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 7	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Powershell Script Block Logging 4104	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`
Sysmon EventID 14	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Cisco Network Visibility Module Flow Data	Network	`cisco:nvm:flowdata`	`not_applicable`
Sysmon EventID 3	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4946	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4947	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log RemoteConnectionManager 1149	Windows	`wineventlog`	`WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational`
Windows Event Log Security 4948	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`

References

Source: GitHub | Version: 2