Detection rules › Splunk
SimpleHelp Remote Access Tool Execution (Windows Event Log)
Threat actors may install remote access tools (RATs) to maintain persistent access to compromised systems. Tools like SimpleHelp or JWrapper Remote Access are often abused for stealthy remote control, masquerading as legitimate IT support tools. This use case detects process creation events with file paths or executable names related to SimpleHelp Remote Access. - LOLRMM
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
id: '44775.89768'
title: SimpleHelp Remote Access Tool Execution
description: Threat actors may install remote access tools (RATs) to maintain persistent
access to compromised systems. Tools like SimpleHelp or JWrapper Remote Access are
often abused for stealthy remote control, masquerading as legitimate IT support
tools. This use case detects process creation events with file paths or executable
names related to SimpleHelp Remote Access. - LOLRMM
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) "JWrapper-Remote" OR "SimpleHelp" OR "SimpleService"
OR "SimpleGatewayService" | where (match(process_name, "(?i)(Simple(help(customer)?|service|gatewayservice)|remote\saccess|windows\slauncher)\.exe")
and match(process_path, "(?i)JWrapper-Remote\s+(Access|Support)")) or match(process_name,
"(?i)Simple(help(customer)?|service|gatewayservice)\.exe") | table _time, host,
user, signature_id, process, process_name, process_path `group_events("host", 5)` '
techniques:
- command-and-control:remote access software
technique_id:
- T1219
data_category:
- Windows event logs
references:
- https://lolrmm.io/tools/simplehelp
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_remote_access_tools_simple_help/
- https://simple-help.com/downloads
- https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
Stages and Predicates
Stage 1: search
search (EventCode=4688 OR Type="Process") source="*" source IN ("WinEventLog:Security", "XmlWinEventLog:Security")
Stage 2: where
where ((match(process_name, "(?i)(Simple(help(customer)?|service|gatewayservice)|remote\saccess|windows\slauncher)\.exe") match(process_path, "(?i)JWrapper-Remote\s+(Access|Support)")) OR match(process_name, "(?i)Simple(help(customer)?|service|gatewayservice)\.exe"))
Stage 3: table
table _time, host, process, process_name, process_path, signature_id, user
Stage 4: bucket
bucket _time
Stage 5: stats
stats BY host, _time
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"4688" |
process_name | regex_match |
| field:"process_name" kind:regex_match |
process_path | regex_match |
| field:"process_name" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>4688<" |
| 1 | "JWrapper-Remote" |
| 1 | "SimpleHelp" |
| 1 | "SimpleService" |
| 1 | "SimpleGatewayService" |