Scheduled Task Executing Encoded Payload from Registry

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects the creation of a scheduled task using 'schtasks.exe' that is configured to execute a PowerShell command. The PowerShell command specifically attempts to retrieve a base64 encoded payload from the Windows Registry (HKCU or HKLM hive) and execute it. This technique is often used by adversaries for persistence and to evade detection by obfuscating the malicious payload.