NetSupport Manager

Threat actors are abusing Microsoft Teams external chat and email bombing to impersonate IT support and facilitate unauthorized remote access to corporate endpoints.

This brief details the detection of DNS queries targeting commonly abused Remote Monitoring and Management (RMM) or remote access software domains, originating from non-browser processes, which is a common tactic for command and control, persistence, and lateral movement by threat actors.

Tracking brief for the ClickFix campaign; individual sightings are folded in as reported.

This rule detects the execution of NetSupport remote access software from non-default paths, potentially indicating an adversary abusing NetSupport Manager for malicious remote control.

Detects process creation events indicative of remote management tools, potentially signifying legitimate use or malicious exploitation by threat actors abusing RMM software.