Windows Task Scheduler persistence using svchost-launched PowerShell with hidden/Bypass flags
Alerts on svchost.exe Schedule tasks spawning PowerShell with hidden window and execution policy bypass flags.
- Product
- windows
- Category
- process_creation
- Author
- pH-T (Nextron Systems), Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-04-08
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation where svchost.exe starts the Schedule service and the resulting command line ends with PowerShell flags commonly used to hide the PowerShell window and weaken script execution restrictions (e.g., hidden window style and execution policy bypass). Such behavior is important because it can enable stealthy persistence by running PowerShell on a schedule with reduced visibility and controls. It relies on Windows process creation telemetry, matching the parent image/command context and specific trailing PowerShell command-line arguments.
Reporting behind it
- blog.malwarebytes.comhttps://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_powershell_persistence.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Task Scheduler persistence using svchost-launched PowerShell with hidden/Bypass flags
id: 635ec306-5bd0-4b40-bacd-e6259b78d327
related:
- id: 6e8811ee-90ba-441e-8486-5653e68b2299
type: similar
- id: b66474aa-bd92-4333-a16c-298155b120df
type: derived
status: test
description: This rule flags process creation where svchost.exe starts the Schedule service and the resulting command line ends with PowerShell flags commonly used to hide the PowerShell window and weaken script execution restrictions (e.g., hidden window style and execution policy bypass). Such behavior is important because it can enable stealthy persistence by running PowerShell on a schedule with reduced visibility and controls. It relies on Windows process creation telemetry, matching the parent image/command context and specific trailing PowerShell command-line arguments.
references:
- https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_schtasks_powershell_persistence.yml
author: pH-T (Nextron Systems), Florian Roth (Nextron Systems), Huntrule Team
date: 2022-04-08
modified: 2023-02-03
tags:
- attack.privilege-escalation
- attack.execution
- attack.persistence
- attack.t1053.005
- attack.t1059.001
logsource:
product: windows
category: process_creation
detection:
selection:
ParentImage: C:\WINDOWS\System32\svchost.exe
ParentCommandLine|contains|all:
- -k netsvcs
- -s Schedule
CommandLine|endswith:
- " -windowstyle hidden"
- " -w hidden"
- " -ep bypass"
- " -noni"
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1