TASK#STOMP Backdoor Uses Scheduled Tasks and PowerShell for Stealthy Document Theft
Written by AI from the linked story. Not reviewed by an editor. How this works
TASK#STOMP exploits Windows scheduled tasks and PowerShell — two built-in, trusted system components — to establish persistent access and continuously exfiltrate sensitive business documents without triggering standard defenses. By compiling C# code at runtime, the malware evades signature-based detection, making traditional antivirus solutions insufficient. This attack highlights the danger of leaving PowerShell unrestricted and scheduled task creation unmonitored in enterprise environments. The continuous, automated nature of the document theft means that even a brief window of undetected access can result in significant data loss with long-term business consequences.
Tactical Insight
Immediate actions
- Audit and restrict PowerShell execution policies to only allow signed scripts via Group Policy or endpoint management tools.
- Review all scheduled tasks across endpoints for unauthorized or suspicious entries and remove any that cannot be attributed to known software.
- Enable PowerShell Script Block Logging and Module Logging to capture runtime-compiled code execution.
Detection measures
- Deploy SIEM rules to alert on anomalous scheduled task creation, especially those spawning PowerShell or compiling code at runtime.
- Monitor outbound data transfers for unusual volume or frequency patterns indicative of document exfiltration.
- Implement Endpoint Detection and Response (EDR) solutions capable of detecting in-memory C# compilation and living-off-the-land techniques.
Long-term improvements
- Apply the principle of least privilege to all user and service accounts to limit the blast radius of a compromised session.
- Establish a Data Loss Prevention (DLP) policy to classify and restrict unauthorized transfer of sensitive business documents.
- Conduct regular threat-hunting exercises focused on misuse of native Windows utilities such as PowerShell, Task Scheduler, and MSBuild.