VBScript Creating Windows Services or Adding Users

Ankit Mehta@Secvyn

•updated Jun 23, 2026•5•0•2

Detects VBScript (wscript.exe or cscript.exe) attempting to create Windows services using 'sc.exe create' or adding new users using 'net user /add'. This behavior is often associated with persistence mechanisms or privilege escalation by malicious scripts.