Scheduled Task Creation via schtasks.exe Spawned by wscript/cscript (Lampion VBS Persistence)

Luís Marques@remotecodeexecution

•updated Jul 23, 2026•7•0•8

Detects the creation of scheduled tasks using the 'schtasks.exe' utility, where the parent process is a Windows script host ('wscript.exe' or 'cscript.exe'). This is a common technique used by malware for persistence.