# IOCs — CVE-2024-57726 (SimpleHelp Technician → Server Admin)
# Source: Lyrie lab reproduction + public disclosures
# Updated: 2026-04-25

[ http-request-signatures ]
POST /api/v1/auth/login                             # role=technician returned
POST /api/v1/keys body{ scope: "server-admin" }     # over-scoped mint (the bug)
GET  /api/v1/admin/users                            # admin endpoint hit by technician-issued key
GET  /api/v1/admin/sessions
POST /api/v1/admin/users
DELETE /api/v1/admin/keys/*

[ behavioral-signatures ]
TECHNICIAN_ROLE → KEY_CREATE(scope=server-admin)        within 60s of session start
KEY_USE on /api/v1/admin/*                              within 60s of issuance
Single source IP performs login → key-mint → admin call within < 5s (automation hallmark)

[ log-patterns ]
auth.login user=<tech> role=technician
keys.create issued_to=<tech> issuer_role=technician scope=server-admin
admin.users.list authenticated_via=api_key issuer_role=technician

[ vulnerable-versions ]
SimpleHelp Server <= 5.5.7

[ fixed-versions ]
SimpleHelp Server >= 5.5.8

[ kev-listing ]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-57726

[ associated-threat-actors ]
Storm-1175 (Microsoft Threat Intelligence) — leveraged in Medusa ransomware operations
DragonForce ransomware affiliates (TrendMicro tracking)

[ network-controls ]
Block external access to /api/v1/admin/* on SimpleHelp Server
Restrict /api/v1/keys to authenticated management subnets
Alert on any technician-role session generating non-technician-scope tokens
