Windows Task Scheduler persistence using svchost-launched PowerShell with hidden/Bypass flags

title: Windows Task Scheduler persistence using svchost-launched PowerShell with hidden/Bypass flags
id: 635ec306-5bd0-4b40-bacd-e6259b78d327
related:
  - id: 6e8811ee-90ba-441e-8486-5653e68b2299
    type: similar
  - id: b66474aa-bd92-4333-a16c-298155b120df
    type: derived
status: test
description: This rule flags process creation where svchost.exe starts the Schedule service and the resulting command line ends with PowerShell flags commonly used to hide the PowerShell window and weaken script execution restrictions (e.g., hidden window style and execution policy bypass). Such behavior is important because it can enable stealthy persistence by running PowerShell on a schedule with reduced visibility and controls. It relies on Windows process creation telemetry, matching the parent image/command context and specific trailing PowerShell command-line arguments.
references:
  - https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_powershell_persistence.yml
author: pH-T (Nextron Systems), Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-08
modified: 2023-02-03
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
  - attack.t1059.001
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage: C:\WINDOWS\System32\svchost.exe
    ParentCommandLine|contains|all:
      - -k netsvcs
      - -s Schedule
    CommandLine|endswith:
      - " -windowstyle hidden"
      - " -w hidden"
      - " -ep bypass"
      - " -noni"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1