APT29 used "scheduler" and "schtasks" to create new tasks on remote hosts as part of lateral movement. They have manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted during the 2020 SolarWinds intrusion. They previously used named and hijacked scheduled tasks to also establish persistence.