Powershell Stop-ScheduledTask Command in HTTP Response

Tim Peck@timpeck

•updated Nov 11, 2025•0•21

This rule detects the 'Stop-ScheduledTask' PowerShell cmdlet within the HTTP response body, indicating that a client on the internal network is receiving a command to stop a scheduled task. This could be part of an adversary's attempt to disable persistence mechanisms or disrupt system operations.