```yaml
title: Suspicious Persistence via Scheduled Tasks or PowerShell
id: edr-win-persist-schtask-abuse
status: stable
description: >
Detects persistence attempts via scheduled tasks or PowerShell from unverified
or suspicious parent processes. Catches schtasks /create with short intervals
invoking scripting engines or download cradles, PowerShell New-ScheduledTaskAction
with suspicious payloads, and XML-based task creation from temp/public paths.
references:
- https://attack.mitre.org/techniques/T1053/005/
author: ShroudCloud
date: 2026/04/16
tags:
- attack.persistence
- attack.t1053.005
logsource:
category: process_creation
product: windows
detection:
parent_process:
ParentImage|endswith:
- '\cmd.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
- '\wmic.exe'
- '\mshta.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\powershell_ise.exe'
- '\wmiprvse.exe'
- '\wsmprovhost.exe'
- '\winrshost.exe'
parent_name:
ParentOriginalFileName|endswith:
- 'Command Prompt'
- 'Microsoft ® Windows Based Script Host'
- 'Microsoft ® Console Based Script Host'
- 'Windows host process (Rundll32)'
- 'Microsoft(C) Register Server'
- 'WMI Commandline Utility'
- 'Microsoft (R) HTML Application host'
- 'Windows PowerShell'
- 'PowerShell'
- 'Windows PowerShell ISE'
- 'WMI Provider Host'
- 'Host process for WinRM plug-ins'
- "Host Process for WinRM's Remote Shell plugin"
parent_signed:
ParentCodeSignature:
- 'valid'
- 'verified'
parent_exclusion:
ParentImage|endswith:
- '\gpscript.exe'
- '\msiexec.exe'
schtasks_create:
Image|endswith: '\schtasks.exe'
CommandLine|contains:
- '/create'
- '-create'
schtasks_interval:
CommandLine|contains:
- 'once'
- 'minute'
- 'hourly'
- 'daily'
- 'onlogon'
- 'onstart'
schtasks_payload:
CommandLine|contains:
- 'curl'
- 'wget'
- 'downloadstring'
- 'get-itemproperty'
- 'cmd.exe /c'
- 'powershell'
- 'pwsh.exe'
- 'mshta'
- 'wscript'
- 'cscript'
- 'rundll32'
- 'ssh'
- 'python'
- '$env:'
schtasks_xml:
Image|endswith: '\schtasks.exe'
CommandLine|contains:
- '/xml'
- '-xml'
xml_staging_path:
CommandLine|contains:
- 'c:\windows\temp\'
- 'c:\temp\'
- '\perflogs\'
- '\users\public\'
powershell_task:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
CommandLine|contains: 'New-ScheduledTaskAction'
powershell_payload:
CommandLine|contains:
- 'curl'
- 'wget'
- 'downloadstring'
- 'cmd.exe /c'
- 'powershell'
- 'pwsh.exe'
- 'mshta'
- 'wscript'
- 'cscript'
- 'rundll32'
- 'ssh'
- 'python'
- '$env:'
condition: >
(parent_process or parent_name) and not parent_signed and not parent_exclusion and (
(schtasks_create and schtasks_interval and schtasks_payload)
or (schtasks_xml and xml_staging_path)
or (powershell_task and powershell_payload) )
falsepositives:
- Legitimate scheduled tasks created by IT admin scripts (baseline by parent and workflow)
level: high
```