Djinn Stealer/TaskWeaver via SimpleHelp RMM Post-Exploitation (CVE-2026-48558)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects the execution of common command-line interface tools (such as PowerShell, cmd, wscript, and certutil) spawned by the SimpleHelp remote support binary ('simplehelp.exe'). It also monitors for specific network connections associated with the SimpleHelp infrastructure (IP 96.126.130.126 on port 58942) that may indicate remote support activity or misuse of the platform.