Suspicious VBS Persistence Task Creation
Detects the creation of a scheduled task configured to execute a VBScript from a user's AppData folder. This technique is used by adversaries, including the Dead#Vax campaign, to establish persistence via an indirect execution flow, often to evade detections focused on direct PowerShell or cmd.exe task actions.
Microsoft Sentinel (KQL)
