TaskWeaver JS Loader Delivered via SimpleHelp RMM Technician Session

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•5

This rule detects potential TaskWeaver malware loader activity by monitoring for suspicious process execution patterns within a SimpleHelp Remote Monitoring and Management (RMM) context. Specifically, it triggers when a SimpleHelp process launches common scripting interpreters (wscript.exe, cscript.exe, node.exe, powershell.exe, cmd.exe) or when a file named 'jquery.js', a known lure filename used by TaskWeaver, is executed.