Scheduled Task persistence

schtasks /create /tn "Update" /tr "C:\payload.exe" /sc onlogon /rl highest

Creates a scheduled task that executes the payload at every logon with maximum privileges.

Use it when you need persistence that runs with high privileges (SYSTEM with /ru SYSTEM) and survives reboots. It's ransomware's favorite persistence: created in a second and managed with schtasks without touching the registry.

If the SOC correlates task creation with 4698/4702 (standard rule), the task triggers immediately. Avoid it on hosts with Application Whitelisting where schtasks.exe is blocked by policy.