Windows SimpleService Execution via Remote Access Tool Wrapper Paths
Flags Windows processes running SimpleService.exe from remote access tool wrapper directories.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-02-23
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies process creation on Windows where the executable path ends with SimpleService.exe and is contained within remote access tool wrapper directories (JWrapper-Remote Access or JWrapper-Remote Support). Attackers can abuse legitimate remote support software to establish interactive control over target systems, making this activity important to flag. The detection relies on process creation telemetry capturing the full image path.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows SimpleService Execution via Remote Access Tool Wrapper Paths
id: cba5ba53-0a1a-4c40-8623-b0c701a762f2
status: test
description: This rule identifies process creation on Windows where the executable path ends with SimpleService.exe and is contained within remote access tool wrapper directories (JWrapper-Remote Access or JWrapper-Remote Support). Attackers can abuse legitimate remote support software to establish interactive control over target systems, making this activity important to flag. The detection relies on process creation telemetry capturing the full image path.
references:
- https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_simple_help.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-02-23
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
category: process_creation
product: windows
detection:
selection:
Image|contains:
- \JWrapper-Remote Access\
- \JWrapper-Remote Support\
Image|endswith: \SimpleService.exe
condition: selection
falsepositives:
- Legitimate usage of the tool
level: medium
license: DRL-1.1
related:
- id: 95e60a2b-4705-444b-b7da-ba0ea81a3ee2
type: derived