SimpleHelp Remote Access Tool Execution (Sysmon)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Threat actors may install remote access tools (RATs) to maintain persistent access to compromised systems. Tools like SimpleHelp or JWrapper Remote Access are often abused for stealthy remote control, masquerading as legitimate IT support tools. This use case detects process creation events with file paths or executable names related to SimpleHelp Remote Access. - LOLRMM

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1219` Remote Access Tools

References

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

id: '44775.89974'
title: SimpleHelp Remote Access Tool Execution
description: Threat actors may install remote access tools (RATs) to maintain persistent
  access to compromised systems. Tools like SimpleHelp or JWrapper Remote Access are
  often abused for stealthy remote control, masquerading as legitimate IT support
  tools. This use case detects process creation events with file paths or executable
  names related to SimpleHelp Remote Access. - LOLRMM
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "JWrapper-Remote" OR "SimpleHelp" OR "SimpleService" OR "SimpleGatewayService" |
  where (match(process_name, "(?i)(Simple(help(customer)?|service|gatewayservice)|remote\saccess|windows\slauncher)\.exe")
  and match(process_path, "(?i)JWrapper-Remote\s+(Access|Support)")) or match(process_name,
  "(?i)Simple(help(customer)?|service|gatewayservice)\.exe") | table _time, host,
  user, signature_id, process, process_name, process_path `group_events("host", 5)` '
techniques:
- command-and-control:remote access software
technique_id: 
- T1219
data_category:
- Windows Sysmon
references:
- https://lolrmm.io/tools/simplehelp
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_remote_access_tools_simple_help/
- https://simple-help.com/downloads
- https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708

Stages and Predicates

Stage 1: `search`

search EventCode=1 source="*" source IN ("WinEventLog:Microsoft-Windows-Sysmon/Operational", "XmlWinEventLog:Microsoft-Windows-Sysmon/Operational")

Stage 2: `where`

where ((match(process_name, "(?i)(Simple(help(customer)?|service|gatewayservice)|remote\saccess|windows\slauncher)\.exe") match(process_path, "(?i)JWrapper-Remote\s+(Access|Support)")) OR match(process_name, "(?i)Simple(help(customer)?|service|gatewayservice)\.exe"))

Stage 3: `table`

table _time, host, process, process_name, process_path, signature_id, user

Stage 4: `bucket`

bucket _time

Stage 5: `stats`

stats BY host, _time

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`1` corpus 241 (splunk 225, kusto 15, elastic 1)	`field:"EventID" kind:eq value:"1"`
`process_name`	regex_match	`"(?i)(Simple(help(customer)?\|service\|gatewayservice)\|remote\saccess\|windows\slauncher).exe"` corpus 2 (splunk 2) `"(?i)Simple(help(customer)?\|service\|gatewayservice).exe"` corpus 2 (splunk 2)	`field:"process_name" kind:regex_match`
`process_path`	regex_match	`"(?i)JWrapper-Remote\s+(Access\|Support)"` corpus 2 (splunk 2)	`field:"process_name" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>1<"`
1	`"JWrapper-Remote"`
1	`"SimpleHelp"`
1	`"SimpleService"`
1	`"SimpleGatewayService"`