Suspicious 'icacls' Grant on JWrapper or SimpleHelp Folders
Detects the use of 'icacls.exe' to grant 'Full Control' permissions to 'Everyone' on directories used by JWrapper and the SimpleHelp RMM tool. This behavior was observed in campaigns where threat actors use JWrapper to package and deliver the SimpleHelp RAT, and this command ensures the malware has unrestricted access to its installation folders.
Sigma
