Abuse of PowerShell Cmdlets for Scheduled Task Manipulation

Threat actors frequently abuse the Windows Task Scheduler to establish persistence, achieve privilege escalation, or ensure recurring execution of malicious payloads. By utilizing native PowerShell cmdlets such as Register-ScheduledTask or through direct WMI/CIM method calls to the TaskScheduler namespace, attackers can create or modify system tasks without requiring external binaries or manual interaction with the GUI. This technique is particularly effective in environments where PowerShell is trusted and Script Block Logging is not actively monitored, allowing attackers to blend in with legitimate administrative automation. Defenders must focus on the invocation of specific task-related cmdlets to differentiate malicious persistence mechanisms from benign system management scripts.

Attack Chain

1. The attacker gains initial access to the target host via phishing or exploit.
2. The attacker identifies the need for recurring code execution for persistence.
3. The attacker executes a PowerShell command using New-ScheduledTaskAction and New-ScheduledTaskTrigger to define the payload and timing.
4. The attacker defines a security context for the task using New-ScheduledTaskPrincipal.
5. The attacker finalizes the configuration using New-ScheduledTaskSettingsSet.
6. The attacker uses Register-ScheduledTask or Invoke-CimMethod to commit the task to the Windows Task Scheduler.
7. The scheduled task executes the malicious payload upon the next trigger event (e.g., system boot, user login).

Impact

Successful abuse of the Windows Task Scheduler allows attackers to maintain long-term access to compromised systems, even after system reboots. This capability is commonly used by various threat actors to deploy ransomware, exfiltrate data, or deploy additional C2 implants across enterprise networks.

Recommendation

Deploy the provided Sigma rule to identify unauthorized task creation. Ensure PowerShell Script Block Logging (Event ID 4104) is enabled across the endpoint estate to capture the specific cmdlets used during task registration. Audit all existing scheduled tasks for unexpected actions or suspicious command-line arguments.