Another persistence method adversaries use is to schedule a task that allows them to execute their malicious program at a specified time or during system startup. Windows utilities such as schtasks and at are normally used by the adversaries to schedule a program or script to execute at a desired date and time. By making use of these utilities, an attacker can create tasks on a local computer or remote computer, provided the account used to create the task is part of an Administrator group. In the following example, the malware (ssub.exe) first creates a file called service.exe in the %AllUsersProfile%\WindowsTask\ directory and then invokes cmd.exe,  which in turn uses the schtasks Windows utility to create a scheduled task for persistence:

[CreateFile] ssub.exe:3652 > %AllUsersProfile%\WindowsTask\service.exe
[CreateProcess] ssub.exe:3652 > "%WinDir%\System32\cmd.exe /C schtasks /create /tn MyApp /tr %AllUsersProfile%\WindowsTask\service.exe /sc ONSTART /f"
[CreateProcess] cmd.exe:3632 > "schtasks /create /tn MyApp /tr %AllUsersProfile%\WindowsTask\service.exe /sc ONSTART /f

To detect this type of persistence, one can use the Sysinternals Autoruns or the task scheduler utility to list currently scheduled tasks. You should consider monitoring the changes to the tasks that are not related to the legitimate programs. You can also monitor the command-line arguments passed to the system utilities such as cmd.exe, which may be used to create tasks. Tasks may also be created using management tools such as PowerShell and Windows Management Instrumentation (WMI), so appropriate logging and monitoring should help in detecting this technique.