Powershell Get-ScheduledTask Command in HTTP Response

Tim Peck@timpeck

•updated Nov 11, 2025•1•0•34

This rule detects the 'Get-ScheduledTask' PowerShell cmdlet within the HTTP response body, specifically when the HTTP status code is 200. This could indicate an attacker enumerating scheduled tasks on a compromised system via a web-based command and control channel or data exfiltration.