SimpleHelp - PowerShell Downloading Ransomware Payload (T1105)

Ibrahim Saud@tektrix

•updated Jun 23, 2026•2•0•2

Detects SimpleHelp executing PowerShell to download ransomware encryptor payloads (like LockBit or BlackCat) from external, untrusted infrastructure. This rule specifically looks for PowerShell commands using Invoke-WebRequest or Net.WebClient to download executable, DLL, or ZIP files, where the initiating process is 'JWrapper' (associated with SimpleHelp).