Windows SimpleService Execution via Remote Access Tool Wrapper Paths

title: Windows SimpleService Execution via Remote Access Tool Wrapper Paths
id: cba5ba53-0a1a-4c40-8623-b0c701a762f2
status: test
description: This rule identifies process creation on Windows where the executable path ends with SimpleService.exe and is contained within remote access tool wrapper directories (JWrapper-Remote Access or JWrapper-Remote Support). Attackers can abuse legitimate remote support software to establish interactive control over target systems, making this activity important to flag. The detection relies on process creation telemetry capturing the full image path.
references:
  - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_simple_help.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-02-23
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - \JWrapper-Remote Access\
      - \JWrapper-Remote Support\
    Image|endswith: \SimpleService.exe
  condition: selection
falsepositives:
  - Legitimate usage of the tool
level: medium
license: DRL-1.1
related:
  - id: 95e60a2b-4705-444b-b7da-ba0ea81a3ee2
    type: derived