Potential Persistence Via Powershell Search Order Hijacking - Task

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•19

Detects suspicious PowerShell execution initiated by a scheduled task (svchost.exe -k netsvcs -s Schedule) where the PowerShell command line includes flags commonly used to hide the PowerShell instance or bypass execution policies, such as '-windowstyle hidden', '-w hidden', '-ep bypass', or '-noni'. This pattern is indicative of persistence mechanisms, specifically referencing the PowerShell 'Get-Variable' technique used by Colibri Loader.