UNC2452 used "scheduler" and "schtasks" to create new tasks on remote hosts as part of lateral movement. They also manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. UNC2452 also created a scheduled task to maintain SUNSPOT persistence when the host booted.