Kimsuky Hidden 'Edge Updater' Scheduled Task Spawning wscript.exe Loader

Ibrahim Saud@tektrix

•updated Jul 2, 2026•2•0•7

Detects a persistent loading pattern attributed to the Kimsuky threat group. The rule monitors for the creation of a hidden scheduled task named 'Edge Updater' that triggers a wscript.exe process executing a disguised VBScript file named with an 'OfficeUpdater' naming convention. This detection covers both the task registration (Event ID 4698) and the subsequent execution of the malicious script via wscript.exe.