Scheduled Task Executing Encoded Payload from Registry — Detection Rule
Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.
Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.