During Operation CuckooBees, the threat actors used scheduled tasks to execute batch scripts for lateral movement with the following command: SCHTASKS /Create /S <IP Address> /U <Username> /p <Password> /SC ONCE /TN test /TR <Path to a Batch File> /ST <Time> /RU SYSTEM.