TaskWeaver backdoor install and C2 via SimpleHelp RMM (Sua Sponte/SHADOW#REACTOR)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

This rule monitors for suspicious activity originating from RMM software (specifically SimpleHelp) and associated TaskWeaver processes, including process execution, service/scheduled task installation, file creation consistent with Djinn Stealer, and non-standard outbound network connections.