Operation Poisson: Scheduled Task Persistence via Script Interpreter

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects the creation of scheduled tasks using 'schtasks.exe' or PowerShell's 'Register-ScheduledTask' cmdlet. The detection focuses on command lines that include indicators of suspicious activity, such as encoded commands, hidden window styles, or placement in temporary or application data directories, specifically when the initiating process is not a signed Microsoft binary.