Dead#Vax Persistence via VBS Scheduled Task

Ernesto Lleras@ernesto

•updated Mar 10, 2026•1•3•46

Detects the creation of a scheduled task designed to execute a VBScript from a temporary or user-specific directory. This technique is used by the Dead#Vax malware to establish persistence with a layer of indirection, avoiding direct PowerShell execution from the task itself.