Powershell Create Scheduled Task

Title: Powershell Create Scheduled Task
Status: test
Description:Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-4---powershell-cmdlet-scheduled-task
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-6---wmi-invoke-cimmethod-scheduled-task
Author: frack113
Date: 2021-12-28
modified:2025-10-07
Tags:

• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.persistence'
• -'attack.t1053.005'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection_cmdlet:
    ScriptBlockText|contains:
      -'New-ScheduledTaskAction'
      -'New-ScheduledTaskTrigger'
      -'New-ScheduledTaskPrincipal'
      -'New-ScheduledTaskSettingsSet'
      -'New-ScheduledTask'
      -'Register-ScheduledTask'

  selection_cimmethod:
    ScriptBlockText|contains|all:
      -'Invoke-CimMethod'
      -'-ClassName'
      -'PS_ScheduledTask'
      -'-NameSpace'
      -'Root\Microsoft\Windows\TaskScheduler'

  filter_main_legitimate_scripts:
    ScriptBlockText|contains|all:
      -'Microsoft.PowerShell.Core\Export-ModuleMember'
      -'Microsoft.Management.Infrastructure.CimInstance'
      -'__cmdletization_methodParameter'

  condition:1 of selection_* and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium