CryptoBandits Scheduled Task Persistence via schtasks /xml for wscript/cscript
Detects the creation of scheduled tasks from XML files in 'C:\Users\Public\Documents\' by 'schtasks.exe' and subsequent execution of JavaScript payloads via 'wscript.exe' or 'cscript.exe' from the same public documents directory. This activity is attributed to the CryptoBandits threat group.
Microsoft Sentinel (KQL)
