Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.
Read the full analysis on IntelFusions