Scheduled Tasks

Leaves behind forensic artifacts Tracks task creation and execution Lots of room to hide though Must be admin to create/modify on remote systems

Can use to get SYSTEM beacon

Windows Customer Experience Improvement Program task can be modified