SimpleHelp Configuration File Modification
Detects the creation or modification of the SimpleHelp RMM configuration file (serviceconfig.xml). Threat actors have been observed using SimpleHelp as part of a chained RMM attack, and this file contains the C2 server configuration.
Microsoft Sentinel (KQL)
