huntrule

Suspicious Scheduled Task Recovery Diagnostics Running PowerShell Script via process_creation

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-30
Updated
2026-09-30
AnalysisDetection

ATT&CK techniques

Execution → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects schtasks.exe creating a scheduled task named Recovery Diagnostics that executes a new.ps1 script under the SYSTEM context. The threat actor used this task to run their PowerShell tooling with elevated privileges under a benign maintenance name, establishing persistence ahead of data exfiltration and ransomware deployment.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange
Suspicious Scheduled Task Application Maintenance Executing Core Payload
Malicious Scheduled Task Executing Binary from NETLOGON
Suspicious Scheduled Task Creation with Recurring Minute Interval
Suspicious Scheduled Task Creation for rclone Exfiltration by The Gentlemen RaaS (via process_creation)
Suspicious Scheduled Task Creation via schtasks
Malicious Scheduled Task Masquerading as svchost by Estate Ransomware
Suspicious High-Frequency Scheduled Task Persistence via schtasks
Suspicious Scheduled Task Executing Binary from User-Writable Directory
Suspicious Scheduled Task Created to Run at System Startup
Suspicious Scheduled Task Recovery Diagnostics Running PowerShell Script via process_creation
Pivot detection · T1053.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.