Threat report

thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise

https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/

Published on: thedfirreport.com
Sources in this catalogue: 3

ATT&CK techniques those detections carry

T1595Active Scanning
T1021Remote Services
T1021.004SSH
T1036Masquerading
T1036.008Masquerade File Type
T1053.005Scheduled Task
T1059Command and Scripting Interpreter
T1059.005Visual Basic
+9 more

11 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
Potential SSH Reverse Port Forwarding	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Windows RunMRU Registry Key or Value Deleted	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows NetSupport RMM DLL Loaded By Uncommon Process	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Executable Masquerading as Benign File Types	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows EventLog Recon Activity Using Log Query Utilities	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0
Potential Dropper Script Execution Via WScript/CScript/MSHTA	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Potentially Suspicious EventLog Recon Activity Using Log Query Utilities	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Potential SSH Tunnel Persistence Install Using A Scheduled Task	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Renamed PingCastle Binary Execution	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
PUA - PingCastle Execution From Potentially Suspicious Parent	High	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
PUA - PingCastle Execution	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 11 of 11

Filter in the catalogue