Scheduled tasks are a Windows automation feature used to run programs, scripts, or commands at set times or in response to events such as logon or startup. In legitimate environments, they help with maintenance, updates, and housekeeping. In attacks, the same feature becomes a persistence mechanism: malware can create a task that relaunches itself after reboot, restarts a failed payload, or runs under a trusted account context.
This matters because scheduled tasks are normal operating-system plumbing, so malicious entries can blend in with real administration work. Defenders should review new or unexpected tasks, unusual names, odd trigger times, suspicious command lines, and executables stored in user-writable locations. Correlating task creation with endpoint process activity and unusual network behavior, including DNS traffic, often helps reveal when a host has been configured to keep malware alive.