During the SolarWinds Compromise, It used scheduler and schtasks to create new tasks on remote host as part of their lateral movement. They manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. It also created a scheduled task to maintain SUNSPOT persistence when the host booted.