Remote Access Tool - SimpleHelp Execution

SigmaHQ Detections@sigmaHQ

•updated Jun 13, 2025•9•0•22,248

This rule detects the execution of SimpleHelp remote access software. SimpleHelp is a legitimate desktop support and remote access tool that adversaries may abuse to establish command and control (C2) channels. The rule specifically looks for process creation events where the image path contains "JWrapper-Remote Access" or "JWrapper-Remote Support" and the executable name is "SimpleService.exe". This pattern indicates the execution of the SimpleHelp service component.