Scheduled Task Executing Encoded Payload from Registry

SigmaHQ Detections@sigmaHQ

•updated Feb 4, 2023•0•0•0

Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.