huntrule

Windows Task Scheduler persistence using svchost-launched PowerShell with hidden/Bypass flags

Alerts on svchost.exe Schedule tasks spawning PowerShell with hidden window and execution policy bypass flags.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
pH-T (Nextron Systems), Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-04-08
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Execution → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation where svchost.exe starts the Schedule service and the resulting command line ends with PowerShell flags commonly used to hide the PowerShell window and weaken script execution restrictions (e.g., hidden window style and execution policy bypass). Such behavior is important because it can enable stealthy persistence by running PowerShell on a schedule with reduced visibility and controls. It relies on Windows process creation telemetry, matching the parent image/command context and specific trailing PowerShell command-line arguments.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange
Suspicious Scheduled Task Launching rundll32 DLL via Ransomware
Suspicious Scheduled Task Creation in Public Writable Directory via schtasks (via process_creation)
Suspicious Scheduled Task Executing Payload from AppData
Suspicious Scheduled Task Running PowerShell Every Minute (via process_creation)
Scheduled Task Creating Per-Minute Hidden PowerShell Execution
Windows Process Creation: schtasks.exe Creating Scheduled Task Launching Registry-Stored PowerShell Payload
Windows schtasks.exe Create Executes File from AppData\Local
Windows schtasks Creates Registry-Backed Base64 PowerShell Payload via Encoded Command
Windows ChromeLoader Execution via Scheduled Task and Hidden PowerShell Launch
Windows Task Scheduler persistence using svchost-launched PowerShell with hidden/Bypass flags
Pivot detection · T1053.005 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.