{
  "Name": "SimpleHelp",
  "Category": "RMM",
  "Description": "SimpleHelp is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "Phyo Paing Htun",
  "Created": "2025-03-05",
  "LastModified": "2025-03-05",
  "Details": {
    "Website": "https://simple-help.com/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [
      "windows"
    ],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "simplehelpcustomer.exe",
      "simpleservice.exe",
      "simplegatewayservice.exe",
      "remote access.exe",
      "windowslauncher.exe",
      "spsrv.exe",
      "serviceconfig.xml"
    ]
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "user_managed",
          "simple-help.com",
          "51.255.19.178",
          "51.255.19.179"
        ],
        "Ports": [
          443
        ]
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/simplehelp_network_sigma.yml",
      "Description": "Detects potential network activity of SimpleHelp RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/simplehelp_processes_sigma.yml",
      "Description": "Detects potential processes activity of SimpleHelp RMM tool"
    }
  ],
  "References": [
    "https://simple-help.com/remote-support",
    "https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708",
    "https://www.group-ib.com/blog/muddywater-infrastructure/"
  ],
  "Acknowledgement": []
}