SimpleHelp - Anomalous Outbound Connections (T1071)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Identifies the SimpleHelp binaries making outbound network connections to untrusted/anomalous IPs, bypassing the configured corporate RMM domains. This rule specifically looks for processes named 'JWrapper*.exe' making network connections to URLs that do not end with 'simple-help.com' or a specified corporate RMM domain, and to remote IPs that are not within the 10.0.0.0/8 private range.