PowerShell Scheduled Task Creation via ScheduledTasks Cmdlets and CIM WMI Calls (Windows)

title: PowerShell Scheduled Task Creation via ScheduledTasks Cmdlets and CIM WMI Calls (Windows)
id: abc4cf9d-59b3-436a-aa7c-c60c4eca8ec4
status: test
description: This rule flags PowerShell script block content that creates and registers Windows scheduled tasks using scheduled-tasks cmdlets (e.g., New-ScheduledTaskAction/Trigger/Principal/Settings and Register-ScheduledTask) or invokes the PS_ScheduledTask CIM method through Invoke-CimMethod targeting the TaskScheduler namespace. Attackers use this behavior to schedule initial or recurring execution of malicious code for persistence or later execution. The detection relies on Script Block Logging telemetry to match specific script block strings and on filtering to reduce matches from module export and CIM cmdletization artifacts.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-4---powershell-cmdlet-scheduled-task
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-6---wmi-invoke-cimmethod-scheduled-task
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_cmdlet_scheduled_task.yml
author: frack113, Huntrule Team
date: 2021-12-28
modified: 2025-10-07
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_cmdlet:
    ScriptBlockText|contains:
      - New-ScheduledTaskAction
      - New-ScheduledTaskTrigger
      - New-ScheduledTaskPrincipal
      - New-ScheduledTaskSettingsSet
      - New-ScheduledTask
      - Register-ScheduledTask
  selection_cimmethod:
    ScriptBlockText|contains|all:
      - Invoke-CimMethod
      - -ClassName
      - PS_ScheduledTask
      - -NameSpace
      - Root\Microsoft\Windows\TaskScheduler
  filter_main_legitimate_scripts:
    ScriptBlockText|contains|all:
      - Microsoft.PowerShell.Core\Export-ModuleMember
      - Microsoft.Management.Infrastructure.CimInstance
      - __cmdletization_methodParameter
  condition: 1 of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 363eccc0-279a-4ccf-a3ab-24c2e63b11fb
    type: derived