Operation Poisson: TaskAdmin1 Scheduled Task with RunLevel Highest Launching sys.vbs

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects persistence mechanisms associated with 'Operation Poisson', specifically focusing on the creation of a scheduled task named 'TaskAdmin1' with highest privileges that launches 'wscript.exe' with 'sys.vbs' at logon, or the use of Registry Run keys to achieve similar persistence with 'sys.vbs'. It also detects the execution of 'wscript.exe' with 'sys.vbs'.