huntrule

Windows schtasks Creates Registry-Backed Base64 PowerShell Payload via Encoded Command

Flags schtasks.exe scheduling that triggers PowerShell to decode a base64 payload pulled from Windows Registry.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
pH-T (Nextron Systems), @Kostastsale, TheDFIRReport, X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-02-12
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule matches Windows process creation where schtasks.exe is used with the /Create option to schedule a command that launches PowerShell. The command line includes indicators of base64 decoding (FromBase64String) and retrieval of data from Windows Registry hives such as HKCU/HKLM, suggesting an encoded payload is stored and executed. It relies on process creation telemetry, specifically the Image filename and PowerShell-containing command-line substrings.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange
Suspicious Scheduled Task Running PowerShell Every Minute (via process_creation)
Scheduled Task Creating Per-Minute Hidden PowerShell Execution
Windows Process Creation: schtasks.exe Creating Scheduled Task Launching Registry-Stored PowerShell Payload
Windows Task Scheduler persistence using svchost-launched PowerShell with hidden/Bypass flags
Windows schtasks.exe Create Executes File from AppData\Local
Windows ChromeLoader Execution via Scheduled Task and Hidden PowerShell Launch
Windows process command lines matching May 2020 Turla ComRAT command patterns
Windows Security: checkadmin.exe TargetUserName starting with Administr (Event ID 4799)
Windows Scheduled Task Creation via PowerShell Using schtasks.exe with ONLOGON/DAILY/ONIDLE/HOURLY
Windows schtasks Creates Registry-Backed Base64 PowerShell Payload via Encoded Command
Pivot detection · T1053.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.