Operation Poisson: Scheduled Task with Highest Privileges Launching Script Interpreter

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•1

Detects the creation of a Windows scheduled task using 'schtasks.exe' with the 'Highest' run level, configured to execute either 'powershell.exe' or 'wscript.exe'. This pattern is consistent with persistence mechanisms observed in Operation Poisson, where attackers establish elevated, automated execution of scripts.