TaskWeaver JavaScript Loader Executing Djinn Stealer via wscript/cscript/Node.js

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects activities associated with the TaskWeaver JavaScript loader and its potential second-stage payload, Djinn Stealer. It monitors for JavaScript files (like jquery.js) being executed by Windows scripting hosts (wscript.exe, cscript.exe) or Node.js, identifies suspicious child process spawning behavior (e.g., cmd.exe, powershell.exe, system reconnaissance tools) from these scripting engines, and flags outbound network connections by these processes to common web ports that may indicate command-and-control (C2) communication.