T1053.002 Scheduled Task/Job: At

Adversaries may abuse the at utility to perform task scheduling for initial or recurring execution of malicious code. MITRE ATT&CK

2 programs on CmdID 2 Sigma rules T1053.002 on attack.mitre.org

Part of

MITRE ATT&CK

T1053Scheduled Task/Job

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highInteractive AT JobE.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community · Windows

lowScheduled Task/Job AtÖmer Günal, oscd.community · Linux

everyday examples from tldr-pages, CC BY 4.0

Create commands interactively and execute them in 5 minutes (press <Ctrl d> when done) on the page for at

at now + 5 minutesIdentify

Create commands interactively and execute them at a specific time on the page for at

at hh:mmIdentify

Execute a command from stdin at 10:00 AM today on the page for at

echo "command" | at 1000Identify

An example is here when CmdID’s reading of it names T1053.002: a Sigma rule it trips is tagged with it, or its abuse is documented as it.