Check scheduled tasks
windowschecklist
Walkthrough
Enumerate scheduled tasks and what they run. A hit is a task running as SYSTEM or another user that executes a script or binary you can modify.
Commands
cmd
schtasks /query /fo LIST /v
powershell
Get-ScheduledTask