title: Ten Minute Scheduled Task Invoking Windows Script Host
id: 96fb9c98-75a4-4bde-952e-5b8c1d90a0d1
status: experimental
description: >-
  Triage for the recurring VBS task shape expressed by the recovered Lua.
  This can also match legitimate administration and needs host/process context.
author: Existing | v1olet
date: 2026-10-23
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains|all:
      - '/create'
      - '/sc minute'
      - '/mo 10'
      - 'wscript.exe'
  condition: selection
falsepositives:
  - Legitimate recurring administration tasks that invoke VBS every ten minutes
level: medium
tags:
  - attack.t1053.005