T0148 - Scheduled tasks on self hosted runner

In this attack, the attacker gains access to a self-hosted runner, which is a server or a virtual machine that runs the CI/CD pipelines for an organization. Once access is gained, the attacker creates a scheduled task or job that runs at regular intervals, even after the initial attack has been detected and removed. The scheduled task or job can be programmed to perform a variety of malicious activities, such as downloading and executing additional malware or maintaining a persistent backdoor for future attacks.