Detection rules › Splunk
SimpleHelp Remote Access Tool Service Installation (Windows Event Log)
Threat actors may install remote access tools (RATs) as Windows services to maintain persistent access to compromised systems. Tools like SimpleHelp or JWrapper Remote Access are often abused for stealthy remote control, masquerading as legitimate IT support tools. This use case detects the installation of Windows services (event codes 4697 or 7045) where the service binary path matches known patterns associated with SimpleHelp, JWrapper Remote Access, or similarly named executables, indicating potential unauthorized remote access setup. - Windows Security event 4697: The minimum OS version is Server 2016 or Windows 10. Windows Server event 7045: Windows Server 2008 R2 and 7, Windows Server 2012 R2 and 8.1, Windows Server 2016 and 10 - LOLRMM
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1569.002 System Services: Service Execution |
| Persistence | T1543 Create or Modify System Process |
| Privilege Escalation | T1543 Create or Modify System Process |
| Command & Control | T1219 Remote Access Tools |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4697 | A service was installed in the system. |
| Service-Control-Manager | Event ID 7045 | Event ID 7045 |
Rule body yaml
id: '44542.87313'
title: SimpleHelp Remote Access Tool Service Installation
description: 'Threat actors may install remote access tools (RATs) as Windows services
to maintain persistent access to compromised systems. Tools like SimpleHelp or JWrapper
Remote Access are often abused for stealthy remote control, masquerading as legitimate
IT support tools. This use case detects the installation of Windows services (event
codes 4697 or 7045) where the service binary path matches known patterns associated
with SimpleHelp, JWrapper Remote Access, or similarly named executables, indicating
potential unauthorized remote access setup. - Windows Security event 4697: The minimum
OS version is Server 2016 or Windows 10. Windows Server event 7045: Windows Server
2008 R2 and 7, Windows Server 2012 R2 and 8.1, Windows Server 2016 and 10 - LOLRMM'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4697) OR
"<EventID>4697<" OR TERM(EventCode=7045) OR "<EventID>7045<") "jwrapper" OR "simplehelp"
OR "simpleservice" OR "simplegatewayservice" OR "remote access" OR "windowslauncher.exe"
| rex field=_raw "<Data Name=''ServiceFileName''>\"?(?<service_file_path>[^<\"]+)\"?</Data>"|
where match(service_file_path, "(?i)\x5c(Program\sFiles|ProgramData)\x5c(SimpleHelp|JWrapper-Remote\s(Access|Support))(\x5c.*)?\x5c((simplehelpcustomer|simpleservice|simplegatewayservice|remote\saccess)\.exe|windowslauncher\.exe)$")
| table _time, host, user, signature_id, service_* | bin span=1s | stats values(*)
as * by _time, host '
techniques:
- execution:system services
- persistence:create or modify system process
- command-and-control:remote access software
technique_id:
- T1569.002
- T1543
- T1219
data_category:
- Windows event logs
references:
- https://lolrmm.io/tools/simplehelp
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_remote_access_tools_simple_help/
- https://simple-help.com/downloads
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4697) OR "<EventID>4697<" OR TERM(EventCode=7045) OR "<EventID>7045<") "jwrapper" OR "simplehelp" OR "simpleservice" OR "simplegatewayservice" OR "remote access" OR "windowslauncher.exe"
Stage 2: rex
| rex field=_raw "<Data Name='ServiceFileName'>\"?(?<service_file_path>[^<\"]+)\"?</Data>"
Stage 3: where
| where match(service_file_path, "(?i)\x5c(Program\sFiles|ProgramData)\x5c(SimpleHelp|JWrapper-Remote\s(Access|Support))(\x5c.*)?\x5c((simplehelpcustomer|simpleservice|simplegatewayservice|remote\saccess)\.exe|windowslauncher\.exe)$")
Stage 4: table
| table _time, host, user, signature_id, service_*
Stage 5: bucket
| bin span=1s
Stage 6: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
service_file_path | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4697<" |
| 1 | TERM |
| 1 | "<EventID>7045<" |
| 1 | "jwrapper" |
| 1 | "simplehelp" |
| 1 | "simpleservice" |
| 1 | "simplegatewayservice" |
| 1 | "remote access" |
| 1 | "windowslauncher.exe" |