ACTINIUM Scheduled Task Persistence via Wscript

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•24

Detects the creation of a scheduled task using 'schtasks create' in conjunction with 'wscript' and '/e:vbscript', which is a known persistence mechanism used by the ACTINIUM threat group.