Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
13 detections
Filters
Last updated
All Time
Detection languages
5
3
2
1
1
Contributors
10
3
Categories
7
6
6
4
3
Platforms
6
6
5
1
1
Products / Services
8
4
4
1
1
MITRE Techniques
8
7
5
5
5
CVEs
71
71
64
58
49
This rule detects the creation of unauthorized technician accounts in the SimpleHelp RMM platform that follow an OIDC authentication bypass pattern (CVE-2026-48558). It correlates server logs indicating 'New Anon' registration activity with Windows Security Event ID 4720 (User account created), specifically filtering for accounts that do not belong to trusted corporate domains.
This rule detects the exploitation of CVE-2026-48558, a critical OIDC authentication bypass vulnerability in SimpleHelp. The detection logic correlates log events for 'Registering technician login' involving 'New Anon' sessions with subsequent configuration save requests occurring within 30 seconds. This pattern signifies the unauthorized creation of a privileged technician account by an unauthenticated attacker, bypassing standard identity verification.
This rule detects suspicious process activity initiated from or under the context of the SimpleHelp remote access tool. It monitors for common post-exploitation patterns including the execution of Python-based scripts associated with authentication bypass and OIDC credential harvesting, the spawning of Node.js processes, and the execution of common command interpreters (e.g., cmd.exe, powershell.exe, wscript.exe) typically used by adversaries to gain further control over a compromised system.
Detects exploitation of CVE-2026-48558 in SimpleHelp RMM software. This vulnerability allows an attacker to bypass OIDC identity token signature verification, leading to unauthorized creation of a privileged Technician account and MFA bypass, as observed in the Sua Sponte / SHADOW#REACTOR campaigns.
Detects evidence of CVE-2026-48558 exploitation, where SimpleHelp servers fail to cryptographically verify OIDC tokens. This vulnerability allows unauthenticated attackers to create privileged technician accounts and bypass Multi-Factor Authentication (MFA). The rule monitors for 'New Anon' log tags in OIDC authentication flows or unauthorized HTTP POST requests to SimpleHelp technician management endpoints.
Detects the execution of scripting interpreters and remote management tools originating from the SimpleHelp RMM process tree. This activity is indicative of post-exploitation abuse where an attacker, having hijacked a technician session (e.g., via CVE-2026-48558 OIDC bypass), uses the RMM console to execute commands on remote endpoints.
Detects successful exploitation of the CVE-2026-48558 OIDC authentication bypass vulnerability in SimpleHelp. The rule monitors for a forged OIDC response processed by the OIDCAuthenticator followed immediately by the registration of a new technician account marked with the [New Anon] identifier, indicating identity verification failure and unauthorized privileged account creation.
Detects a critical authentication bypass in SimpleHelp servers (CVE-2026-48558) where an adversary leverages a forged OIDC identity token. The rule identifies the sequence of an unverified OIDC response, the failure to issue an MFA session token, successful group-level authentication without a challenge, and the subsequent registration of an unauthenticated '[New Anon]' identity.
This rule detects potential exploitation of the CVE-2026-48558 vulnerability in SimpleHelp servers by monitoring for specific sequences of log markers related to authentication bypass and unauthorized configuration changes. It flags anomalous technician registrations, OIDC attribute fetching, and 'New Anon' configuration saves within a 60-second window, which are indicative of an attacker attempting to gain unauthorized access or manipulate session security.
Detects the exploitation of a vulnerability in the SimpleHelp OIDC authentication flow where an attacker can register a forged technician account and self-register MFA during the first login, effectively bypassing mandatory multi-factor authentication requirements. The detection looks for specific sequences in server logs involving OIDC attribute fetching and 'New Anon' technician registration tags.
This rule detects the exploitation of CVE-2026-48558 in SimpleHelp, where an OIDC authentication bypass allows unauthenticated attackers to forge identity tokens. The lack of cryptographic signature verification permits the registration of unauthorized, privileged Technician accounts, effectively bypassing MFA. The detection logic monitors for specific log patterns indicating OIDC response processing followed by technician account registration and configuration changes.
Detects unauthorized processes, such as TaskWeaver implants or scripts (node.exe, wscript.exe, cscript.exe) running from non-standard directories (e.g., %TEMP%, %APPDATA%), attempting to access web browser credential databases. This behavior is indicative of post-exploitation credential harvesting, specifically linked to Djinn Stealer activity following CVE-2026-48558 exploits.
Detects instances where the SimpleHelp RMM agent process initiates a command interpreter or scripting process. This behavior is often indicative of post-exploitation activity, specifically unauthorized script or command execution delivered via a remote support session.