{"id":"T1053.002","name":"At","url":"https://attack.mitre.org/techniques/T1053/002","tactics":["execution","persistence","privilege-escalation"],"platforms":["Windows","Linux","macOS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0333","stix_id":"x-mitre-detection-strategy--ca20fecb-6b8e-49ae-9ecf-19f4edd812ad","name":"Cross-Platform Detection of Scheduled Task/Job Abuse via `at` Utility","url":"https://attack.mitre.org/detectionstrategies/DET0333","analytics":[{"id":"AN0943","stix_id":"x-mitre-analytic--b9f79a81-9fee-47f2-bef8-a9f64fde935e","name":"Analytic 0943","description":"Detects creation of scheduled tasks via `at.exe` or WMI `Win32_ScheduledJob` class, followed by execution of anomalous processes by svchost.exe or taskeng.exe.","url":"https://attack.mitre.org/detectionstrategies/DET0333#AN0943","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4698","data_component":"DC0001","data_component_name":"Scheduled Job Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TaskUser","description":"Unusual users creating jobs (e.g., non-admin accounts or service users)."},{"field":"ExecutionTimeWindow","description":"Delay between task registration and execution."},{"field":"CommandLinePattern","description":"Unexpected script or binary execution (e.g., cmd.exe /c PowerShell payload)."}],"live":true,"detection_strategies":["DET0333"],"techniques":["T1053.002"]},{"id":"AN0944","stix_id":"x-mitre-analytic--70e28077-c8a6-425f-94c7-a74a7140c7ce","name":"Analytic 0944","description":"Detects usage of `at` command to schedule jobs, followed by job execution and modification of job files under /var/spool/cron/atjobs.","url":"https://attack.mitre.org/detectionstrategies/DET0333#AN0944","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"write","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"AtJobPath","description":"Monitoring additional paths (e.g., tmp-mounted spool dirs) for modified at jobs."},{"field":"ScheduleLatency","description":"Expected delay between at job creation and execution."},{"field":"JobScriptEntropy","description":"High entropy or obfuscation in at job payloads."}],"live":true,"detection_strategies":["DET0333"],"techniques":["T1053.002"]},{"id":"AN0945","stix_id":"x-mitre-analytic--98ce32fb-1b91-4487-9e5a-951375f2380e","name":"Analytic 0945","description":"Detects user or root invocation of `at` command to schedule a job, followed by job execution using LaunchServices and activity in /usr/lib/cron/at.","url":"https://attack.mitre.org/detectionstrategies/DET0333#AN0945","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process: at, job runner","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"fs:fsusage","channel":"file access to /usr/lib/cron/at and job execution path","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"fs-fsusage"},{"name":"macos:osquery","channel":"process_events","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"AtPermissions","description":"Whether `at.allow` and `at.deny` are properly configured."},{"field":"ExecutionCommand","description":"Target binary executed via the at job."},{"field":"RunUser","description":"Detection of root user scheduling job with unusual command."}],"live":true,"detection_strategies":["DET0333"],"techniques":["T1053.002"]}],"live":true,"version":"1.0","techniques":["T1053.002"]}],"sigma_rules":[{"id":"0fcd1c79-4eeb-4746-aba9-1b458f7a79cb","title":"Remote Schedule Task Lateral Movement via ATSvc","author":"Sagie Dulce, Dekel Paz","status":"test","level":"high","date":"2022-01-01","modified":null,"description":"Detects remote RPC calls to create or execute a scheduled task via ATSvc","references":["https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931","https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md","https://github.com/zeronetworks/rpcfirewall","https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/"],"logsource":{"product":"rpc_firewall","category":"application"},"tags":["attack.privilege-escalation","attack.lateral-movement","attack.execution","attack.persistence","attack.t1053","attack.t1053.002"],"path":"rules/application/rpc_firewall/rpc_firewall_atsvc_lateral_movement.yml","techniques":["T1053","T1053.002"],"cves":[]},{"id":"60fc936d-2eb0-4543-8a13-911c750a1dfc","title":"Interactive AT Job","author":"E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community","status":"test","level":"high","date":"2019-10-24","modified":"2021-11-27","description":"Detects an interactive AT job, which may be used as a form of privilege escalation.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.002/T1053.002.md","https://eqllib.readthedocs.io/en/latest/analytics/d8db43cf-ed52-4f5c-9fb3-c9a4b95a0b56.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.privilege-escalation","attack.t1053.002"],"path":"rules/windows/process_creation/proc_creation_win_at_interactive_execution.yml","techniques":["T1053.002"],"cves":[]},{"id":"ace3ff54-e7fd-46bd-8ea0-74b49a0aca1d","title":"Remote Schedule Task Lateral Movement via ITaskSchedulerService","author":"Sagie Dulce, Dekel Paz","status":"test","level":"high","date":"2022-01-01","modified":null,"description":"Detects remote RPC calls to create or execute a scheduled task","references":["https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931","https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md","https://github.com/zeronetworks/rpcfirewall","https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/"],"logsource":{"product":"rpc_firewall","category":"application"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.lateral-movement","attack.t1053","attack.t1053.002"],"path":"rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_lateral_movement.yml","techniques":["T1053","T1053.002"],"cves":[]},{"id":"aff229ab-f8cd-447b-b215-084d11e79eb0","title":"Remote Schedule Task Lateral Movement via SASec","author":"Sagie Dulce, Dekel Paz","status":"test","level":"high","date":"2022-01-01","modified":null,"description":"Detects remote RPC calls to create or execute a scheduled task via SASec","references":["https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931","https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md","https://github.com/zeronetworks/rpcfirewall","https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/"],"logsource":{"product":"rpc_firewall","category":"application"},"tags":["attack.privilege-escalation","attack.lateral-movement","attack.execution","attack.persistence","attack.t1053","attack.t1053.002"],"path":"rules/application/rpc_firewall/rpc_firewall_sasec_lateral_movement.yml","techniques":["T1053","T1053.002"],"cves":[]},{"id":"b640c0b8-87f8-4daa-aef8-95a24261dd1d","title":"MITRE BZAR Indicators for Execution","author":"@neu5ron, SOC Prime","status":"test","level":"medium","date":"2020-03-19","modified":"2021-11-27","description":"Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE","references":["https://github.com/mitre-attack/bzar#indicators-for-attck-execution"],"logsource":{"product":"zeek","service":"dce_rpc"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.t1047","attack.t1053.002","attack.t1569.002"],"path":"rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml","techniques":["T1047","T1053.002","T1569.002"],"cves":[]},{"id":"d2d642d7-b393-43fe-bae4-e81ed5915c4b","title":"Scheduled Task/Job At","author":"Ömer Günal, oscd.community","status":"stable","level":"low","date":"2020-10-06","modified":"2022-07-07","description":"Detects the use of at/atd which are utilities that are used to schedule tasks.\nThey are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.002/T1053.002.md"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.002"],"path":"rules/linux/process_creation/proc_creation_lnx_at_command.yml","techniques":["T1053.002"],"cves":[]},{"id":"dde85b37-40cd-4a94-b00c-0b8794f956b5","title":"Remote Task Creation via ATSVC Named Pipe - Zeek","author":"Samir Bousseaden, @neu5rn","status":"test","level":"medium","date":"2020-04-03","modified":"2022-12-27","description":"Detects remote task creation via at.exe or API interacting with ATSVC namedpipe","references":["https://web.archive.org/web/20230409194125/https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html"],"logsource":{"product":"zeek","service":"smb_files"},"tags":["attack.privilege-escalation","attack.execution","attack.lateral-movement","attack.persistence","car.2013-05-004","car.2015-04-001","attack.t1053.002"],"path":"rules/network/zeek/zeek_smb_converted_win_atsvc_task.yml","techniques":["T1053.002"],"cves":[]},{"id":"f6de6525-4509-495a-8a82-1f8b0ed73a00","title":"Remote Task Creation via ATSVC Named Pipe","author":"Samir Bousseaden","status":"test","level":"medium","date":"2019-04-03","modified":"2024-08-01","description":"Detects remote task creation via at.exe or API interacting with ATSVC namedpipe","references":["https://web.archive.org/web/20230409194125/https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.execution","attack.lateral-movement","attack.persistence","car.2013-05-004","car.2015-04-001","attack.t1053.002"],"path":"rules/windows/builtin/security/win_security_atsvc_task.yml","techniques":["T1053.002"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}