INCIDENT runs in your browser and needs JavaScript.
Vlad Guliakin - Case 001Case 001
It’s probably nothing.Investigating anyway.
Case 001NetSupport RAT check-ins from a Windows client
NetSupport Manager RAT signatures fired for 45.131.214[.]85 on TCP port 443, from 2026-02-28 19:55 UTC.
In plain words: A Windows computer on the network kept asking a remote-control server outside the network for orders: 264 times in this capture.
Evidence so far
Exhibit A Evidence Suricata alerts in Zui The alerts in the pcap, counted by signature. The alarm is real in our own evidence.EnlargeExhibit B Evidence Wireshark, Follow TCP Stream, stream 40 One check-in and the server's answer, word by word. A NetSupport client asking an outside server for orders.EnlargeExhibit C Noise Zeek HTTP log in Zui The Windows internet check behind one alert. Harmless: Windows checking that it is online.Enlarge
Optional. Make the call yourself first, then compare it with mine.
My assessmentREAL THREAT
You called it: Real threat. Same call as mine.
You called it: False alarm. I landed the other way, and the reasoning is below.
The alarm is in our own evidence, 264 times (Exhibit A). The packets are real NetSupport check-ins asking for commands, sent to an outside IP on a known RAT control URI over plain HTTP on port 443, and the server answered twice with encoded data (Exhibit B). The one other alert on the host is Windows checking its internet connection, and it is harmless (Exhibit C).
Takeaway: A tool name in an alert is not a verdict: what made this malicious was where it talked to and how.
Exhibit ASuricata alerts in Zui
EvidenceOriginal, unedited
123What it is
Suricata alerts in Zui, counted by signature. By source, destination and port, 528 of them (264 + 264) go from 10.2.28[.]88 to 45.131.214[.]85 on port 443. The two single alerts are the domain controller (10.2.28[.]2) and the Windows connection test in Exhibit C.
Why it mattered
The SIEM alarm is real in our own evidence. The NetSupport check-in rule fired 264 times, the server's response rule twice. The rule for HTTP POST on port 443 also fired 264 times, on the same requests.
My annotations
- 1264 NetSupport check-ins: the alarm, found again in the evidence.
- 2The same 264 requests are plain HTTP POSTs on port 443, the port for encrypted HTTPS.
- 3The server answered only twice.
Annotations are hidden. This is the evidence as it was captured.
My marks and my read of this exhibit stay hidden until you open my assessment.
Log text, original. Select it or copy it.
event_type=="alert" | count() by alert.signature | sort -r count
1{signature: ET INFO NetSupport Remote Admin Checkin} 264
2{signature: ET POLICY HTTP traffic on port 443 (POST)} 264
3{signature: ET INFO NetSupport Remote Admin Response} 2
{signature: SURICATA Applayer Detect protocol only one direction} 1
{signature: ET INFO Microsoft Connection Test} 1
OriginalScreenshot and log text exactly as captured1Annotation: my marks, switch them off any timeNoiseChecked and set aside
Exhibit BWireshark, Follow TCP Stream, stream 40
EvidenceOriginal, unedited
1234What it is
Wireshark filter ip.addr == 45.131.214[.]85, then Follow, TCP Stream, stream 40. The full stream holds 264 client packets and 2 server packets.
Why it mattered
The client calls itself NetSupport Manager/1.3 and POSTs CMD=POLL: it is asking its server for orders. The server answers as NetSupport Gateway/1.92 with encoded data. Two details make this malicious, not just a remote-support tool: the destination, an outside IP that the SIEM already flags, with no company gateway in the environment, where /fakeurl.htm is a known NetSupport RAT control URI; and the port, plain readable HTTP on port 443, the port for encrypted HTTPS.
My annotations
- 1A POST to /fakeurl.htm, a known NetSupport RAT control URI, as plain HTTP on port 443.
- 2The client names itself: NetSupport Manager/1.3.
- 3CMD=POLL: the client asks its server for orders.
- 4The server answers as a NetSupport Gateway, with encoded data.
Annotations are hidden. This is the evidence as it was captured.
My marks and my read of this exhibit stay hidden until you open my assessment.
Log text, original. Select it or copy it.
1POST hxxp://45.131.214[.]85/fakeurl.htm HTTP/1.1
2User-Agent: NetSupport Manager/1.3
Content-Type: application/x-www-form-urlencoded
Content-Length: 22
Host: 45.131.214[.]85
Connection: Keep-Alive
3CMD=POLL
INFO=1
ACK=1
HTTP/1.1 200 OK
4Server: NetSupport Gateway/1.92 (Windows NT)
Content-Type: application/x-www-form-urlencoded
Content-Length: 69
Connection: Keep-Alive
CMD=ENCD
ES=1
DATA=(encoded bytes)
OriginalScreenshot and log text exactly as captured1Annotation: my marks, switch them off any timeNoiseChecked and set aside
Exhibit CZeek HTTP log in Zui
Noise: checked and set asideOriginal, unedited
12What it is
Zeek's HTTP log in Zui, for the server of the one Microsoft Connection Test alert (23.47.50[.]182).
Why I set it aside
This alert is harmless. Windows itself (Microsoft NCSI) asked www.msftconnecttest[.]com for one small text file, /connecttest.txt, to check whether the computer has internet access. Every Windows computer does this. Port 80 is not a problem here: nothing secret is sent.
My annotations
- 1An alert on the infected host, over plain HTTP on port 80.
- 2Windows' own internet check, Microsoft NCSI, asking for /connecttest.txt.
Annotations are hidden. This is the evidence as it was captured.
My marks and my read of this exhibit stay hidden until you open my assessment.
Log text, original. Select it or copy it.
_path=="http" id.resp_h==23.47.50.182 | cut ts, id.orig_h, host, uri, user_agent
ts: 2026-02-28T19:55:09.772238Z
1id.orig_h: 10.2.28[.]88
host: www.msftconnecttest[.]comnoise
uri: /connecttest.txtnoise
2user_agent: Microsoft NCSInoise
OriginalScreenshot and log text exactly as captured1Annotation: my marks, switch them off any timeNoiseChecked and set aside