TaskWeaver JS Loader Execution via Compromised SimpleHelp RMM

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects the execution of Node.js-based JavaScript payloads (notably 'jquery.js') delivered via Remote Monitoring and Management (RMM) sessions, specifically SimpleHelp. The rule monitors for file creation of the payload in sensitive locations, the execution of the payload by Node.js, and subsequent post-exploitation discovery commands executed by the Node.js process.