SimpleHelp Firewall Rule Modification

nomit vyas@xoxo

•updated Jun 22, 2026•0•0•12

Detects the use of netsh.exe to create a firewall rule specifically named "SH Remote Access Service Launcher". This activity is associated with the JWrapper/SimpleHelp RAT, which adds this rule to allow inbound C2 connections, bypassing the system firewall.