Operation Poisson Scheduled Task with Highest Privileges Launching Script Interpreter

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

This rule detects the creation of scheduled tasks using 'schtasks.exe' or Windows Security Event ID 4698, specifically looking for tasks configured to run with 'HighestAvailable' privileges or tasks that execute suspicious script files (sys.vbs, Thal.exe, wscript.exe, cscript.exe). This behavior can indicate an adversary establishing persistence or escalating privileges.