Scheduled task 'WindowsHelper' created to run VBScript launcher every 5 minutes

Ethan Andrews@eandrews

•updated Jul 6, 2026•6•0•9

Detects the creation of a Windows scheduled task named 'WindowsHelper' that is configured to execute a 'run.vbs' script via wscript.exe every five minutes. This behavior is associated with the persistence mechanism used by the Armored Likho BusySnake Stealer malware.