SimpleHelp Permission Weakening via icacls

Ethan Andrews@eandrews

•updated Feb 19, 2026•4•0•34

Detects the execution of icacls.exe to grant 'Full Control' permissions to the 'Everyone' group for the 'C:\ProgramData\SimpleHelp' directory. This tactic is used by the SimpleHelp RAT to ensure it can operate without permission restrictions and facilitate persistence.