Suspicious NetSupport Execution

[rule]
description = """
Identifies a suspicious execution of NetSupport remote access software from non-default paths, issuing a DNS query to a
non-standard NetSupport domain.
"""
id = "ad53a366-161a-4fa7-a75a-cc00658a767f"
license = "Elastic License v2"
name = "Suspicious NetSupport Execution"
os_list = ["windows"]
reference = ["https://www.netsupportsoftware.com/"]
version = "1.0.29"

query = '''
sequence by process.entity_id with maxspan=1m
 [process where process.pe.original_file_name : "client32.exe" and
  process.code_signature.subject_name : "NetSupport Ltd" and
  not process.executable : ("?:\\Program Files\\NetSupport*.exe", "?:\\Program Files (x86)\\NetSupport*.exe") and
  not process.parent.executable : ("?:\\Program Files\\NetSupport*.exe", "?:\\Program Files (x86)\\NetSupport*.exe")]
 [dns where not dns.question.name : "*.netsupportsoftware.com"]
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1219"
name = "Remote Access Tools"
reference = "https://attack.mitre.org/techniques/T1219/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"