A task hiding in the UpdateOrchestrator folder
Event 4698 records every new scheduled task with its full XML. Find the one created by a user, not SYSTEM, read what it runs at logon, and why its folder makes it easy to miss.
Briefing
EDR flagged wscript.exe running a script from C:\Users\Public at logon on WS-OSEI. Logon-triggered tasks are a common way to make that happen.
Event 4698 includes the task name and its XML content. Real Windows tasks in \Microsoft\Windows\ are created by SYSTEM during updates, not by a user in the afternoon.
WS-OSEI · Windows event logs
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.