Interactive privileged shell triggered by schedule task (deprecated)

Detects scenarios where an attacker abuse the at command to elevate privilages. Note that at command is deprecated since Windows 8 and replaced by schtask.