Scheduled Task Execution of Encoded PowerShell Registry Payloads

This threat involves the use of legitimate Windows administrative tools, specifically 'schtasks.exe', to establish persistence by triggering a scheduled task. The scheduled task is configured to execute a PowerShell command that retrieves an obfuscated payload stored within a specific Windows Registry key. By leveraging the 'Get-ItemProperty' cmdlet combined with 'System.Convert::FromBase64String', the attacker decodes and executes the payload directly into memory using 'IEX' (Invoke-Expression). This technique allows for fileless execution, bypassing traditional file-based signature detection. This methodology has been observed in campaigns leading to full domain compromise, where attackers seek to maintain long-term access while minimizing disk footprint. Defenders should focus on monitoring task creation events that reference registry interaction via PowerShell.

Attack Chain

1. Attacker writes an encoded malicious script to a custom registry key (e.g., HKCU:\SOFTWARE\AppDataName) using reg.exe or PowerShell.
2. Attacker executes 'schtasks.exe /Create' to establish a new persistence task.
3. The task is configured with a trigger frequency (e.g., /SC MINUTE /MO 30).
4. The task command-line argument contains a 'powershell -Command' string invoking 'Get-ItemProperty' to fetch the registry data.
5. The retrieved string is passed to 'FromBase64String' for decoding.
6. The decoded payload is piped into 'IEX' for execution within the PowerShell process context.
7. The malicious code runs in the background, typically with the privileges of the user account under which the task is scheduled.

Impact

This technique facilitates stealthy persistence, allowing attackers to maintain access across system reboots. If successful, it often serves as a precursor to credential harvesting, lateral movement, or ransomware deployment, potentially leading to full domain-wide compromise as observed in previous real-world incidents.

Recommendation

• Deploy the Sigma rule below to detect 'schtasks.exe' command-line patterns involving PowerShell registry retrieval and decoding.
• Monitor Windows Event ID 4698 (A scheduled task was created) to identify tasks configured with suspicious command-line arguments.
• Restrict write access to sensitive registry hives (HKLM) to prevent attackers from storing payloads in common configuration locations.