Scheduled Task Creation via schtasks.exe Spawned by wscript or cscript

Luís Marques@remotecodeexecution

•updated today•0•0•0

The rule attempts to find scheduled tasks being created via the "schtasks.exe" binary, when it's parent is "wscript" or "cscript".