HackTool: Default PowerSploit and Empire scheduled task persistence

PowerSploit and Empire frameworks include modules for maintaining persistence on compromised Windows systems by creating scheduled tasks. These modules often employ default naming conventions and execution flags, specifically targeting task names like 'Updater' and executing PowerShell commands with non-interactive flags. This behavior is observable through process creation logs when schtasks.exe is spawned by powershell.exe or pwsh.exe with specific command-line arguments.

Impact

Successful execution of these modules establishes persistence, allowing attackers to maintain access across system reboots or user logons without requiring manual re-exploitation.

Recommendation

• Deploy the provided Sigma rule to detect the use of default persistence task creation patterns.
• Audit existing scheduled tasks for entries named 'Updater' that execute encoded or base-level PowerShell scripts.
• Review environment-wide use of schtasks.exe spawned by PowerShell to identify potentially unauthorized persistence mechanisms.