VBScript Initiating Scheduled Task Creation

Ankit Mehta@Secvyn

•updated Jun 23, 2026•1•0•5

This rule detects the creation of scheduled tasks or 'at' jobs initiated by VBScript engines (wscript.exe or cscript.exe). This behavior can be indicative of malicious activity, such as persistence mechanisms established by malware or phishing attacks that leverage VBScript to schedule future execution.