Topic starter
20/08/2026 5:45 pm
TL;DR: A suspicious PowerShell chain used a download cradle, in-memory execution, and SYSTEM-level scheduled tasks to install proxyware, with the infection traced back to a freeware disk-cleaning utility bundled with malicious scripts, according to Expel. The incident shows how living-off-the-land tools and delayed C2 tasking can hide persistence long enough to turn a benign install into controllable endpoint abuse.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Stories from the SOC: Mystery of the postponed proxyware install”.
Key questions
Q: What breaks when PowerShell and BITSAdmin are allowed to run unchecked on user endpoints?
A: The defender loses the distinction between normal administration and attacker staging.
Q: Why do delayed scheduled tasks increase endpoint compromise risk?
A: Delayed tasks separate the original compromise from the visible malicious action, which makes incident correlation much harder.
Q: What signs suggest a scheduled task is being used for persistence?
A: Suspicious signs include SYSTEM-level tasks created from user-writable paths, tasks that launch scripts or interpreters, and task names that mimic normal system functions.
Practitioner guidance
- Restrict PowerShell to authorised administration paths Limit PowerShell execution on user endpoints, require signed or approved scripts where feasible, and record the command line and parent process for every suspicious invocation.
- Tighten scheduled-task governance Alert on new SYSTEM-level tasks, especially those that launch scripts, Node.js or unusual binaries from user-writable locations or temp paths.
- Block unapproved software installs Use application control to prevent freeware installers and bundled scripts from introducing hidden persistence or unsigned payloads onto managed endpoints.
Bottom line: This incident shows how a benign-looking freeware install can become a staged persistence mechanism that later delivers in-memory PowerShell execution.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:27 pm
Living-off-the-land execution has become a persistence problem, not just an evasion problem. This case depends on trusted tools such as PowerShell, CMD, Node.js and scheduled tasks to move the attack forward without obvious malware files. That shifts the governance question from binary detection to execution authority, script control and service-context abuse. Practitioners should treat local scripting surfaces as part of the endpoint trust model, not as harmless admin convenience.
A question worth separating out:
Q: How should teams respond to proxyware on managed endpoints?
A: Treat proxyware as unauthorised software with potential to sit inside a broader compromise chain, not as a harmless nuisance. Contain the host, remove the persistence mechanism, verify whether the installer brought in additional scripts or tasks, and review whether the same pathway could be used to deliver more dangerous payloads later.
👉 Read our full editorial: Proxyware installs through in-memory PowerShell and hidden startup tasks