Windows Scheduled Task XML Built Via Console Echo

The following analytic detects cmd.exe being used to write a Windows Scheduled Task XML definition to disk through the echo command. This analytic focuses on command lines that combine echo with the Task Scheduler XML namespace. This is a significant activity because legitimate software rarely assembles a task definition on the fly from the console. Browser hijackers and adware droppers do this to create a scheduled task, through schtasks.exe and the generated XML file, that periodically relaunches a copy of themselves, and then delete the XML file to hinder forensic analysis. If confirmed malicious, this could allow an attacker to establish persistence, repeatedly execute a payload and maintain control over the victim's browser.