CISA KEV Alert: Active Exploitation of Samsung MagicINFO, SimpleHelp, and D-Link Flaws

---
title: Potential Path Traversal Exploitation Attempt
id: c4331c88-1b4d-4b5c-9c8d-1d2f3b4c5d6e
status: experimental
description: Detects potential path traversal attempts characteristic of CVE-2024-7399 and CVE-2024-57728 usage in URI strings.
references:
  - https://www.cisa.gov/news-events/alerts/2026/04/24/cisa-adds-four-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/04/24
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: null
detection:
  selection:
    c|contains:
      - '../'
      - '..%2f'
      - '..%5c'
      - '%252e'
  condition: selection
falsepositives:
  - Scanning activity from authorized penetration testing
  - Misconfigured web clients
level: high
---
title: Web Request Command Injection via Shell Metacharacters
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential command injection in web requests indicative of CVE-2025-29635 (D-Link DIR-823X) exploitation.
references:
  - https://www.cisa.gov/news-events/alerts/2026/04/24/cisa-adds-four-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/04/24
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2025.29635
logsource:
  category: webserver
  product: null
detection:
  selection:
    c|contains:
      - '| '
      - '&& '
      - '; '
      - '`'
      - '$('
  filter_main_generic:
    cs-uri-query|contains:
      - 'favicon'
      - '.css'
      - '.js'
  condition: selection and not filter_main_generic
falsepositives:
  - Web application development testing
level: high
---
title: SimpleHelp Remote Support Spawning Shell
id: e5f6g7h8-i9j0-4k1l-m2n3-o4p5q6r7s8t9
status: experimental
description: Detects SimpleHelp support tool processes spawning cmd.exe or powershell.exe, potentially indicating exploitation of CVE-2024-57726.
references:
  - https://www.cisa.gov/news-events/alerts/2026/04/24/cisa-adds-four-known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/04/24
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\SimpleHelp.exe'
      - '\SimpleSupport.Service.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate administrator using SimpleHelp to run diagnostics
level: medium


**KQL (Microsoft Sentinel / Defender)**

// Hunt for Path Traversal and Command Injection in Web Logs
let SuspiciousPatterns = dynamic(['../', '..%2f', '..%5c', '| ', '&& ', '; ', '`', '$(']);
DeviceNetworkEvents
| where ActionType in ('ConnectionSuccess', 'InboundConnectionAccepted')
| where RemoteUrl has_any(SuspiciousPatterns) or RequestFields has_any(SuspiciousPatterns)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RequestFields, RemoteIP
| order by Timestamp desc


**Velociraptor VQL**

-- Hunt for SimpleHelp service binaries and check for suspicious child processes
SELECT Pid, Name, CommandLine, Exe, ParentPid
FROM pslist()
WHERE Name =~ 'SimpleHelp'
   OR Name =~ 'SimpleSupport.Service'
-- Chain lookup to see if these parents spawned cmd or powershell
LET SuspiciousChildren = SELECT Pid, Name, CommandLine, Exe, Parent.Pid AS ParentPid
FROM pslist()
WHERE Name =~ 'cmd.exe' OR Name =~ 'powershell.exe'
SELECT Parent.Name AS ParentProcess, Children.Name AS ChildProcess, Children.CommandLine
FROM pslist() AS Parent
LEFT JOIN SuspiciousChildren AS Children ON Parent.Pid = Children.ParentPid
WHERE Parent.Name =~ 'SimpleHelp'


**Remediation Script (PowerShell)**

# Audit for SimpleHelp Installation
Write-Host "Checking for SimpleHelp installations..."

# Check Common Paths
$paths = @(
    "${env:ProgramFiles}\SimpleHelp",
    "${env:ProgramFiles(x86)}\SimpleHelp",
    "${env:ProgramData}\SimpleHelp"
)

$vulnerableFound = $false

foreach ($path in $paths) {
    if (Test-Path $path) {
        Write-Host "[!] SimpleHelp found at: $path" -ForegroundColor Yellow
        $vulnerableFound = $true
        # Attempt to get version info from the main executable if it exists
        $exePath = Get-ChildItem -Path $path -Recurse -Filter "*.exe" | Select-Object -First 1
        if ($exePath) {
            try {
                $versionInfo = (Get-Item $exePath.FullName).VersionInfo
                Write-Host "    File: $($exePath.Name)"
                Write-Host "    Version: $($versionInfo.FileVersion)"
            } catch {
                Write-Host "    Could not retrieve version information."
            }
        }
    }
}

# Check for Running Services
$service = Get-Service | Where-Object { $_.Name -like "*SimpleHelp*" -or $_.DisplayName -like "*SimpleHelp*" }
if ($service) {
    Write-Host "[!] SimpleHelp Service Running: $($service.DisplayName)" -ForegroundColor Yellow
    Write-Host "    Status: $($service.Status)"
    Write-Host "    StartType: $($service.StartType)"
    $vulnerableFound = $true
}

if (-not $vulnerableFound) {
    Write-Host "No SimpleHelp installations detected." -ForegroundColor Green
} else {
    Write-Host "ACTION REQUIRED: If this software is not authorized for support, remove it. If authorized, update to the latest version immediately to patch CVE-2024-57726 and CVE-2024-57728." -ForegroundColor Red
}