Scheduled-task abuse is a technique where malware uses Windows Task Scheduler or similar job automation features to run code, stay persistent, or elevate privileges. Because scheduled tasks are normal administrative tools, malicious tasks can blend in with routine system maintenance and be overlooked by users and some security tools.
In practice, attackers may create a task that launches a payload at logon, on a timer, or when a trigger condition is met. If the task runs under a powerful context such as NT AUTHORITY\SYSTEM, the malware inherits broad local access and can modify files, change settings, or start additional components. Defenders look for unusual task names, suspicious command lines, new tasks created by uncommon processes, and tasks that point to packed or in-memory payloads. Monitoring task creation and execution is a key way to catch this abuse early.