I published the following diary on isc.sans.org: “Adding Persistence Via Scheduled Tasks“: Once a computer has been infected by a malware, one of the next steps to perform is to keep persistence. Usually, endpoints (workstations) are primary infection vectors due to the use made of it by people: they browse
