Windows Process Creation: Scheduled Task Creation via schtasks and wscript/vbscript

Alerts on Windows command lines that combine schtasks task creation with wscript running VBScript for persistence.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: Andreas Hunkeler (@Karneades) (SigmaHQ), DRL 1.1
Published: 2022-02-07
Updated: 2026-07-31

ATT&CK techniques

Execution → Priv Esc

Recon
Resource Dev
Initial Access
Execution
- T1053Scheduled Task/Job
- T1053.005Scheduled Task
Persistence
- T1053Scheduled Task/Job
- T1053.005Scheduled Task
Priv Esc
- T1053Scheduled Task/Job
- T1053.005Scheduled Task
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creation where the command line contains all of the following: "schtasks", "create", "wscript", and " /e:vbscript". Such activity is commonly used to establish persistence by creating scheduled tasks that execute VBScript through Windows Script Host. It relies on process creation telemetry, specifically the full command line of spawned processes, to match the expected parameter combination.

Reporting behind it

Related detections9 linkedT1053.005 — drag to rearrange

Windows Registry: New TaskCache entry created by unusual process image

Malicious CloudZ RAT Persistence via schtasks Running regasm.exe

Suspicious Scheduled Task Creation for WSPrint Persistence by UAT-9244

Malicious Scheduled Task Masquerading as GoogleUpdate Launching SSH Reverse Shell

Malicious Scheduled Task Creation TaskSystem via Interlock Ransomware

Malicious Scheduled Task Masquerading as Edge Update Running From Temp (via process_creation)

Suspicious Scheduled Task Created From XML Definition (via process_creation)

Malicious Scheduled Task Masquerade for Zardoor Persistence (via process_creation)

Malicious BugSleep Scheduled Task Persistence with Sample Comment

Windows Process Creation: Scheduled Task Creation via schtasks and wscript/vbscript

Pivot detection · T1053.005 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-scheduled-task-persistence-via-schtasks-create-and-vbsc-e1118a8f

title: "Windows Process Creation: Scheduled Task Creation via schtasks and wscript/vbscript"
id: 2454efba-c212-41b9-8468-dd1157c2f54f
status: test
description: 'This rule flags Windows process creation where the command line contains all of the following: "schtasks", "create", "wscript", and " /e:vbscript". Such activity is commonly used to establish persistence by creating scheduled tasks that execute VBScript through Windows Script Host. It relies on process creation telemetry, specifically the full command line of spawned processes, to match the expected parameter combination.'
references:
  - https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/TA/ACTINIUM/proc_creation_win_apt_actinium_persistence.yml
author: Andreas Hunkeler (@Karneades), Huntrule Team
date: 2022-02-07
modified: 2023-03-18
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053
  - attack.t1053.005
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - schtasks
      - create
      - wscript
      - " /e:vbscript"
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e1118a8f-82f5-44b3-bb6b-8a284e5df602
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL