Scheduled task spawns obfuscated PowerShell from ProgramData beaconing out

Arnold Chan@slaz

•updated Sep 23, 2026•0•0•7

Detects instances where PowerShell scripts are executed via the Windows Task Scheduler from within potential staging directories (ProgramData with randomized folder names). The rule identifies execution that uses common PowerShell obfuscation flags (e.g., -EncodedCommand) and requires secondary hardening bypass flags (e.g., -WindowStyle hidden), followed by correlated network activity to a specific suspicious C2 domain.