T1053.002 — At

Tactics: Execution, Persistence, Privilege Escalation · Platforms: Windows, Linux, macOS

Adversaries may abuse the at utility to perform task scheduling for initial or recurring execution of malicious code. The at utility exists as an executable within Windows, Linux, and macOS for scheduling tasks at a specified time and date. Although deprecated in favor of Scheduled Task's schtasks…

Sub-technique of Scheduled Task/Job (T1053).

Sigma detection rules (3)

T1053.002: Scheduled Task/Job: At - Suspicious Command Scheduling via At or WMI

title: "T1053.002: Scheduled Task/Job: At - Suspicious Command Scheduling via At or WMI"
id: d1bab238-229b-4490-9ea2-8feff3e9557c
status: test
description: 'Detects scheduling of a suspicious command via the legacy `at` utility or the WMI Win32_ScheduledJob class (an explicitly documented alternate creation path for the same technique), identified by common LOLBin names appearing in the scheduled command line.'
references:
  - https://attack.mitre.org/techniques/T1053/002/
author: Shahrukh Khan
date: 2026-03-14
license: MIT
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1053.002

logsource:
  category: process_creation
  product: windows

detection:
  selection_wmi:
    Image|endswith:
      - '\wmic.exe'
      - '\powershell.exe'
    CommandLine|contains: 'Win32_ScheduledJob'

  selection_at:
    Image|endswith: '\at.exe'

  condition: 1 of selection_*

falsepositives:
  - Legacy scheduled-job administration by IT using the deprecated at.exe/Win32_ScheduledJob interfaces — rare in modern environments, which is itself a mild positive detection signal.

level: high

T1053.002 Scheduled Task/Job: At

title: "T1053.002 Scheduled Task/Job: At"
id: 950cbc47-ba97-4d61-ae93-ef1f6a6047ba
description: 'Cross-Platform Detection of Scheduled Task/Job Abuse via `at` Utility. Fixes an overly broad a0|endswith: "/at" pattern by anchoring on the full binary path suffix "/bin/at" so unrelated binaries are not swept into this clause. (Retargeted to the file_change auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AtJobPath, ScheduleLatency, JobScriptEntropy.'
references:
  - https://attack.mitre.org/techniques/T1053/002
author: Shahrukh Khan
date: 2026-03-09
license: MIT
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1053.002

logsource:
  category: file_change
  product: linux

detection:
  selection_at:
    type: EXECVE
    a0|endswith: '/bin/at'
  selection_path:
    type: PATH
    name|startswith: '/var/spool/cron/atjobs/'
    nametype: CREATE
  condition: 1 of selection_*

falsepositives:
  - Legitimate one-off job scheduling by administrators using the at command.

level: medium

T1053.002 Scheduled Task/Job: At

title: "T1053.002 Scheduled Task/Job: At"
id: 85938169-60e6-439f-a9d4-f31dc32ede5c
description: 'Cross-Platform Detection of Scheduled Task/Job Abuse via `at` Utility. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AtPermissions, ExecutionCommand, RunUser.'
references:
  - https://attack.mitre.org/techniques/T1053/002
author: Shahrukh Khan
date: 2026-01-22
license: MIT
tags:
  - attack.execution
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1053.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/at'
  selection_time:
    CommandLine|re: '.*(now|noon|midnight|[0-9]{2}:[0-9]{2}).*'
  condition: selection and selection_time

falsepositives:
  - Administrators using the at command for legitimate one-time scheduled maintenance tasks.

level: medium

Related sub-techniques

Explore