Threat Hunting Exercise: Analyzing Windows Scheduled Task Persistence Malicious Payload Dataset
This hunt uses a simulated Windows Security/Sysmon dataset (windows_schtask_persist_2022-08-13T023000.json) capturing T1053.005: Scheduled Task, where an adversary registers a scheduled task disguised with a legitimate-sounding name that runs an encoded PowerShell payload at system startup and every 4 hours thereafter, providing durable, low-visibility persistence.
Step 1: Hypothesis Formation
Hypothesis: A scheduled task is created (Security Event 4698) with a trigger set to At Startup or a short recurring interval, whose action invokes powershell.exe/mshta.exe/rundll32.exe with an encoded or heavily-obfuscated command line, registered under a task name mimicking legitimate system functionality (e.g., "MicrosoftEdgeUpdateTaskMachine" but with a subtle typo or wrong path), created by a non-admin process outside of any software installation event. Indicators:
- Security 4698 (Scheduled Task Created) with
Commandreferencingpowershell -enc,mshta, or a script in a non-standard location (%APPDATA%,%TEMP%). - Task author/creator process is a script or dropper, not
msiexec.exe/a recognized installer. - Task name closely mimics a legitimate Microsoft/vendor task but with subtle differences (extra space, wrong casing, wrong GUID format).
- Task actually fires per Sysmon Event 1, spawning the encoded payload on schedule.
Null Hypothesis: The task is a legitimate software auto-update mechanism (many legitimate applications register their own scheduled tasks for updates). Invalidate via checking the task's binary path against installed/signed software inventory and comparing the task name precisely against the known-legitimate Microsoft task naming convention.
Rationale: Scheduled Task creation is extremely common in legitimate Windows environments, making it a high-noise hunting surface; this hunt validates a name-mimicry plus command-line-obfuscation combined filter to cut through the noise and find the malicious needle.
Step 2: Data Sources and Scope
- Sources: Security log (Event 4698 Scheduled Task Created, 4700/4702 for enable/update); Sysmon (Event 1 process create, correlating task-triggered executions); Task Scheduler operational log.
- Scope: ~2022-08-13T02:30:00-03:00:00 UTC; Host: WKS-MKT-051 (10.160.4.9); Task name:
MicrosoftEdgeUpdateTaskMachine Core(legitimate name isMicrosoftEdgeUpdateTaskMachineCore, no space). - SIEM Queries (Splunk/ELK):
- Task creation with encoded PowerShell:
index=winsecurity EventID=4698 TaskContent="powershell-enc" OR TaskContent="mshta*" - Name-mimicry check:
index=winsecurity EventID=4698 | eval similarity=levenshtein(TaskName, known_legit_task_names) | where similarity <= 3 AND TaskName!=known_legit_task_names - Task-triggered execution:
index=sysmon EventID=1 ParentImage="taskeng.exe" OR ParentImage="svchost.exe" CommandLine="-enc"
Step 3: Key Findings
Parsed events (6 shown) confirm a scheduled task mimicking a legitimate Microsoft Edge update task was created to run encoded PowerShell every 4 hours.
| Timestamp (UTC) | Host | Event | Details | IOC/Why Suspicious? |
|---|---|---|---|---|
| 2022-08-13 02:31:05 | WKS-MKT-051 | Security 4698 | TaskName=\Microsoft\Windows\MicrosoftEdgeUpdateTaskMachine Core; Author=SYSTEM (created via a script running as SYSTEM, not msiexec) | Name-mimicry IOC: extra space before "Core" - the genuine Microsoft task has no space; a subtle, easily-overlooked difference. |
| 2022-08-13 02:31:05 | WKS-MKT-051 | Security 4698 | Action=powershell.exe -nop -w hidden -enc SQBFAFgA...; Trigger=At startup + Repeat every 4 hours | Command IOC: encoded PowerShell action - the real Edge update task invokes MicrosoftEdgeUpdate.exe directly, never PowerShell. |
| - | WKS-MKT-051 | (creating process) | Task created by wscript.exe running a .vbs dropped minutes earlier from a phishing attachment | Origin IOC: legitimate software installers create their own update tasks via MSI/signed installers, not via a wscript-launched VBS dropper. |
| 2022-08-13 02:31:10 | WKS-MKT-051 | Sysmon 1 | taskeng.exe spawns powershell.exe (same encoded command) - immediate first firing at creation-plus-startup trigger | Confirms the task is live and functional immediately after registration. |
| 2022-08-13 06:31:12 | WKS-MKT-051 | Sysmon 1 | Same spawn repeats, exactly 4 hours later | Interval IOC: confirms the recurring trigger is firing precisely as configured - durable persistence. |
| - | WKS-MKT-051 | (software inventory) | Legitimate Edge installation on this host uses task name MicrosoftEdgeUpdateTaskMachineCore (no space), registered by msiedge_installer.msi | Legitimacy check IOC: direct side-by-side comparison confirms the malicious task is a near-perfect but detectably distinct impersonation. |
Validation:
- Timeline: Phishing-delivered VBS dropper → mimicked scheduled task creation → immediate and then 4-hourly recurring execution - a complete, functioning persistence chain hiding in plain sight among legitimate-looking task names.
- False Positives: Direct comparison against the genuine Microsoft task name and creation method (installer vs. script) conclusively distinguishes the malicious task.
- Correlation: Single host, single task, single dropper - isolated persistence mechanism tied to a specific phishing delivery.
Step 4: Recommendations & Next Steps
- Immediate Response: Delete the malicious scheduled task; kill any running instances of the encoded PowerShell payload; identify and remove the originating VBS dropper and its phishing delivery artifact; isolate WKS-MKT-051 for further forensic review; decode the base64 payload to determine second-stage functionality and any additional IOCs.
- Detection: Sigma-style rule:
title: Scheduled Task Name Mimics Legitimate Task with Encoded Command→selection: EventID=4698 AND TaskContent contains "-enc" AND TaskName fuzzy-matches known_legitimate_task_names but != exact_match- build and maintain a reference list of your environment's genuine recurring task names/paths for comparison. - Pro Tip: Baseline the exact set of legitimate scheduled tasks (name, path, trigger, action binary, and creating installer) across a representative set of clean hosts, and treat any near-duplicate name as higher scrutiny than a completely novel one - attackers mimic recognizable names specifically to blend into a defender's mental model of "normal," so exact-match comparison is essential.
Hypothesis confirmed - a scheduled task mimicking a legitimate Microsoft Edge update task was used to persist an encoded PowerShell payload with a 4-hour recurring trigger!