Powershell New-ScheduledTask Cmdlet in HTTP Response Body

Tim Peck@timpeck

•updated Nov 11, 2025•0•16

This rule detects the presence of the PowerShell cmdlet 'New-ScheduledTask' and related parameters ('-action', '-trigger', '-taskname', '-settings') within the HTTP response body. This could indicate a system receiving instructions to create a scheduled task, potentially for persistence or execution of malicious code. The detection specifically looks for successful HTTP status code 200 responses.