A telemetry task that is not from Office
Trace a VBScript from a zipped invoice through Sysmon process events to the scheduled task it created. Name the task, its interval, and the script it keeps re-running.
Briefing
b.ortiz opened an invoice zip from email on Mar 11. Nothing seemed to happen, so she deleted it. The script inside did not need to stay in the zip.
schtasks /create /sc minute /mo N runs a task every N minutes. /tn is the task name, and attackers often hide it under \Microsoft\ to look built in.
WKS-0431 · Sysmon triage
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.