VBScript-created 'Edge Updater' scheduled task for persistent wscript re-execution

Ibrahim Saud@tektrix

•updated Jul 2, 2026•1•0•4

Detects execution of OfficeUpdater VBScript via wscript.exe or cscript.exe with specific command line arguments, or the creation of corresponding .ini configuration files. This pattern is indicative of potential malicious activity or persistence mechanisms mimicking legitimate update processes.