Operation Poisson Scheduled Task Persistence via Script Interpreter

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the creation of scheduled tasks designed for persistence, typically used by Operation Poisson (e.g., Demon agent, Python keyloggers). The rule identifies tasks that execute script interpreters (powershell.exe, cmd.exe, wscript.exe, cscript.exe, python.exe, pythonw.exe) with indicators of suspicious intent, such as hidden windows (/WindowStyle Hidden, /c) or elevated privileges (HighestAvailable, HighestPrivilege, AtLogon).