Windows Task Host Privilege Escalation Now Exploited by Ransomware Gangs — CISA KEV Detection and Remediation Guide

---
title: Suspicious Child Process Spawned by Windows Task Host
description: Detects command interpreters, script engines, or LOLBins spawned by taskhostw.exe, consistent with privilege escalation via the actively exploited Windows Task Host vulnerability now used by ransomware gangs.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\taskhostw.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
      - '\vssadmin.exe'
      - '\bcdedit.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; some legacy administrative scheduled tasks may spawn cmd.exe. Validate against registered task names.
level: high
---
title: Scheduled Task Created and Immediately Executed as SYSTEM
description: Detects creation of scheduled tasks configured to run with SYSTEM or highest privileges followed by rapid execution, a common pattern when Task Scheduler flaws or schtasks abuse are used for privilege escalation and ransomware staging.
references:
  - https://attack.mitre.org/techniques/T1053/005/
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/04/06
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains:
      - '/create'
    CommandLine|contains_any:
      - '/ru SYSTEM'
      - '/ru "SYSTEM"'
      - '/rl HIGHEST'
  condition: selection
falsepositives:
  - Legitimate software installers and IT administrative task creation. Filter on known-good command lines and signing.
level: medium
---
title: Ransomware Pre-Encryption Staging via Elevated Context
description: Detects shadow copy deletion and boot recovery tampering commands executed under elevated parent processes, consistent with ransomware operator activity following successful privilege escalation.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/04/06
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
  selection_bcd:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_wbcd:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains: 'delete'
  condition: 1 of selection_*
falsepositives:
  - Backup solutions occasionally manage shadow copies. Correlate with maintenance windows and backup agent service accounts.
level: critical

// Hunt for anomalous Task Host child processes and rapid task-creation-to-execution chains
// consistent with Windows Task Host privilege escalation used by ransomware operators.
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","vssadmin.exe","bcdedit.exe","wbadmin.exe","wmic.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "taskhostw.exe"
| where FileName in~ (suspiciousChildren)
| extend TaskArguments = tostring(InitiatingProcessCommandLine)
| summarize ExecutionCount = count(), DistinctDevices = dcount(DeviceId)
    by DeviceName, FileName, ProcessCommandLine, AccountName, InitiatingProcessCommandLine
| order by ExecutionCount asc
;
// Correlate: scheduled task creation followed by SYSTEM-context execution within 10 minutes
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create"
    and (ProcessCommandLine has "SYSTEM" or ProcessCommandLine has "HIGHEST")
| extend TaskName = extract(@'/tn\s+"?([^"\s]+)', 1, ProcessCommandLine)
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName =~ "taskhostw.exe"
) on DeviceId
| where TimeGenerated1 between (TimeGenerated .. TimeGenerated + 10m)
| project DeviceName, TaskCreatedTime=TimeGenerated, TaskName, CreatorCommand=ProcessCommandLine,
    ExecutedProcess=FileName1, ExecutedCommand=ProcessCommandLine1, AccountName1

-- Hunt for suspicious Task Host worker processes with anomalous children or command lines
-- across the estate, indicating Task Scheduler privilege escalation abuse.
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)taskhostw'
  AND (CommandLine =~ '(?i)(cmd|powershell|pwsh|mshta|rundll32|regsvr32|vssadmin|bcdedit)'
       OR Username =~ '(?i)SYSTEM')

-- Enumerate recently created scheduled tasks for persistence / escalation review
SELECT Name, FullPath, CommandLine, TimeStamps
FROM glob(globs='C:\\Windows\\System32\\Tasks\\**')
WHERE TimeStamps.ModificationTime > timestamp(epoch=now() - 604800)
ORDER BY TimeStamps.ModificationTime DESC

# Audit and verification script: Windows Task Host / Task Scheduler exposure review
# Run elevated. Review output before removing any tasks.

# 1. Confirm OS build and installed hotfixes for patch validation
$os = Get-CimInstance Win32_OperatingSystem
Write-Host "== OS Build ==" -ForegroundColor Cyan
Write-Host "$($os.Caption) - Build $($os.BuildNumber).$($os.Version)"
Write-Host "`n== Recently Installed Hotfixes (last 60 days) ==" -ForegroundColor Cyan
Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date).AddDays(-60) } |
    Sort-Object InstalledOn -Descending | Format-Table HotFixID, Description, InstalledOn

# 2. Flag scheduled tasks registered or modified in the last 14 days running as SYSTEM
Write-Host "`n== Recently Modified SYSTEM-Context Scheduled Tasks ==" -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-14)
Get-ScheduledTask | ForEach-Object {
    $task = $_
    $info = Get-ScheduledTaskInfo -TaskName $task.TaskName -TaskPath $task.TaskPath -ErrorAction SilentlyContinue
    try {
        $regPath = "C:\Windows\System32\Tasks$($task.TaskPath)$($task.TaskName)"
        $writeTime = (Get-Item $regPath -ErrorAction Stop).LastWriteTime
        if ($writeTime -gt $cutoff -and $task.Principal.UserId -match 'SYSTEM|LOCAL SERVICE|NETWORK SERVICE') {
            [PSCustomObject]@{
                TaskName   = $task.TaskName
                TaskPath   = $task.TaskPath
                RunAs      = $task.Principal.UserId
                LastWrite  = $writeTime
                Action     = ($task.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join '; '
            }
        }
    } catch {}
} | Format-List

# 3. Detect anomalous taskhostw.exe child processes from recent security telemetry (requires Sysmon or 4688 logging)
Write-Host "`n== Anomalous taskhostw.exe Child Process Events (last 7 days) ==" -ForegroundColor Cyan
$suspect = 'cmd.exe','powershell.exe','pwsh.exe','mshta.exe','rundll32.exe','vssadmin.exe','bcdedit.exe','wbadmin.exe'
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'taskhostw\.exe' -and ($suspect | Where-Object { $_.ToString() -and $Matches } ) } |
    Select-Object TimeCreated, Message -First 25 | Format-List
# Note: if Sysmon is deployed, query the 'Microsoft-Windows-Sysmon/Operational' log Event ID 1 instead
# for richer ParentImage/CommandLine correlation.

# 4. Verify Volume Shadow Copies are intact (ransomware pre-encryption check)
Write-Host "`n== Volume Shadow Copy Status ==" -ForegroundColor Cyan
vssadmin list shadows