Renamed SimpleHelp RMM Persistence

Tim Peck@timpeck

•updated Feb 16, 2026•1•0•44

Detects the execution of a SimpleHelp RMM executable from a non-standard file path. This behavior is associated with threat actors establishing persistence after exploiting vulnerabilities like CVE-2026-1731 in BeyondTrust appliances.