Elastic Defend high stable eql

Suspicious NetSupport Execution

Identifies a suspicious execution of NetSupport remote access software from non-default paths, issuing a DNS query to a non-standard NetSupport domain.

View Source

Detection Logic

sequence by process.entity_id with maxspan=1m
 [process where process.pe.original_file_name : "client32.exe" and
  process.code_signature.subject_name : "NetSupport Ltd" and
  not process.executable : ("?:\\Program Files\\NetSupport*.exe", "?:\\Program Files (x86)\\NetSupport*.exe") and
  not process.parent.executable : ("?:\\Program Files\\NetSupport*.exe", "?:\\Program Files (x86)\\NetSupport*.exe")]
 [dns where not dns.question.name : "*.netsupportsoftware.com"]

Field Validations

Loading…

Comments (0)

Loading comments...