Operation Poisson: Scheduled Task Persistence at ONLOGON with HighestAvailable Privileges

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the creation of Windows Scheduled Tasks using either 'schtasks.exe' or 'powershell.exe' (via 'Register-ScheduledTask') with specific persistence flags, such as 'ONLOGON', 'ONSTART', 'SYSTEM' privileges, or 'HighestAvailable' execution levels. This behavior is commonly used by adversaries for persistence or privilege escalation.