CTI · reviewed · 2026-09-24

TASK#STOMP PowerShell Backdoor Steals Business Documents and Executes Remote Commands

Full story & timeline

MITRE ATT&CK

• T1059 Command and Scripting Interpreter Execution
• T1053 Scheduled Task/Job Execution
• T1547 Boot or Logon Autostart Execution Persistence
• T1099 Timestomp Stealth
• T1005 Data from Local System Collection
• T1113 Screen Capture Collection

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: TASK#STOMP PowerShell Backdoor Staging and Persistence
id: 4f8c2a16-9d3e-4b7a-85c1-2e6f0d9a7b34
status: experimental
description: Detects TASK#STOMP backdoor staging and persistence artifacts reported in case analysis - Windows Script Host running a VBScript from the user's Desktop, references to the WinDefendSvc staging folder and its hidden PowerShell loaders sysloader.ps1 and winconn.ps1 with DAT payloads diagpack.dat and winconncfg.dat, msdiag.vbs in the Startup folder, and schtasks creating tasks from XML files under LOCALAPPDATA
references:
  - https://gbhackers.com/taskstomp-powershell-backdoor/
  - https://cyberpress.org/taskstomp-backdoor-steals-documents/
  - https://securityonline.info/taskstomp-powershell-backdoor/
author: Tia N. List
date: 2026-09-24
tags:
  - attack.execution
  - attack.persistence
  - attack.collection
  - attack.t1059
  - attack.t1053
  - attack.t1547
  - attack.t1099
  - attack.t1005
  - attack.t1113
logsource:
  product: windows
  category: process_creation
detection:
  selection_wsh_desktop_vbs:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
    CommandLine|contains|all:
      - '\Desktop\'
      - '.vbs'
  selection_staged_payloads:
    CommandLine|contains:
      - 'WinDefendSvc'
      - 'sysloader.ps1'
      - 'winconn.ps1'
      - 'diagpack.dat'
      - 'winconncfg.dat'
      - 'msdiag.vbs'
  selection_schtasks_from_xml:
    Image|endswith:
      - '\schtasks.exe'
    CommandLine|contains|all:
      - '/create'
      - '/xml'
      - '\AppData\'
  condition: selection_wsh_desktop_vbs or selection_staged_payloads or selection_schtasks_from_xml
falsepositives:
  - IT or software distribution scripts creating scheduled tasks from XML definitions under AppData
  - Administrative scripts referencing documents in user Desktop folders
level: high

YARA-X raw

rule TASKSTOMP_Powershell_Backdoor {
    meta:
        author = "Tia N. List"
        date = "2026-09-24"
        status = "experimental"
        description = "TASK#STOMP Windows backdoor staging artifacts: WinDefendSvc staging folder, msdiag.vbs Startup persistence, hidden PowerShell loaders sysloader.ps1/winconn.ps1 and Base64 DAT payloads diagpack.dat/winconncfg.dat. Derived from case analysis - NOT validated against a live sample."
        reference = "https://cyberpress.org/taskstomp-backdoor-steals-documents/"
        falsepositives = "Research writeups or cleanup tooling embedding the same artifact names; treat as a hunting signal, not a verdict"
    strings:
        $windefend_svc = "WinDefendSvc" ascii nocase
        $msdiag = "msdiag.vbs" ascii nocase
        $sysloader = "sysloader.ps1" ascii nocase
        $winconn = "winconn.ps1" ascii nocase
        $diagpack = "diagpack.dat" ascii nocase
        $winconncfg = "winconncfg.dat" ascii nocase
    condition:
        3 of them
}

References

• https://gbhackers.com/taskstomp-powershell-backdoor/
• https://cyberpress.org/taskstomp-backdoor-steals-documents/
• https://securityonline.info/taskstomp-powershell-backdoor/