Scheduled Task Executing Payload from Registry

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•0•2

Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.