Scheduled Task Executing Payload from Registry — Detection Rule

Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.