SimpleHelp CVE-2026-48558 OIDC JWT Bypass — Auth Script and Post-Exploit

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•9

This rule detects suspicious process activity initiated from or under the context of the SimpleHelp remote access tool. It monitors for common post-exploitation patterns including the execution of Python-based scripts associated with authentication bypass and OIDC credential harvesting, the spawning of Node.js processes, and the execution of common command interpreters (e.g., cmd.exe, powershell.exe, wscript.exe) typically used by adversaries to gain further control over a compromised system.