SigmaHQ/rules/windows/process_creation/win_interactive_at.yml

title: Interactive AT Job
id: 60fc936d-2eb0-4543-8a13-911c750a1dfc
description: Detect an interactive AT job, which may be used as a form of privilege escalation
status: experimental
author: E.M. Anhaus (orignally from Atomic Blue Detections, Endgame), oscd.community
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053/T1053.yaml
    - https://eqllib.readthedocs.io/en/latest/analytics/d8db43cf-ed52-4f5c-9fb3-c9a4b95a0b56.html
date: 2019/10/24
modified: 2019/11/11
tags:
    - attack.privilege_escalation
    - attack.t1053.002
    - attack.t1053  # an old one
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\at.exe'
        CommandLine|contains: 'interactive'
    condition: selection
fields:
    - ComputerName
    - User
    - CommandLine
falsepositives:
    - Unlikely (at.exe deprecated as of Windows 8)
level: high
Added Atomic Blue Detections Repo 2019-10-28 10:59:49 +00:00			`title: Interactive AT Job`
UUIDs + moved unsupported logic * Added UUIDs to all contributed rules * Moved unsupported logic directory out of rules/ because this breaks CI testing. 2019-12-19 22:56:36 +00:00			`id: 60fc936d-2eb0-4543-8a13-911c750a1dfc`
Update win_interactive_at.yml 2019-11-11 01:06:37 +00:00			`description: Detect an interactive AT job, which may be used as a form of privilege escalation`
Added Atomic Blue Detections Repo 2019-10-28 10:59:49 +00:00			`status: experimental`
Update win_interactive_at.yml 2019-11-11 01:05:21 +00:00			`author: E.M. Anhaus (orignally from Atomic Blue Detections, Endgame), oscd.community`
Update win_interactive_at.yml 2019-11-11 01:06:37 +00:00			`references:`
			`- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053/T1053.yaml`
			`- https://eqllib.readthedocs.io/en/latest/analytics/d8db43cf-ed52-4f5c-9fb3-c9a4b95a0b56.html`
Added Atomic Blue Detections Repo 2019-10-28 10:59:49 +00:00			`date: 2019/10/24`
Update win_interactive_at.yml 2019-11-11 01:05:21 +00:00			`modified: 2019/11/11`
Added Atomic Blue Detections Repo 2019-10-28 10:59:49 +00:00			`tags:`
			`- attack.privilege_escalation`
Initial round of subtechnique updates 2020-06-16 20:46:08 +00:00			`- attack.t1053.002`
att&ck tags review: windows/process_creation part 3 2020-09-01 17:02:36 +00:00			`- attack.t1053 # an old one`
OSCD QA wave 3 2020-01-19 21:34:16 +00:00			`logsource:`
			`category: process_creation`
			`product: windows`
Added Atomic Blue Detections Repo 2019-10-28 10:59:49 +00:00			`detection:`
			`selection:`
Update win_interactive_at.yml 2019-11-11 01:05:21 +00:00			`Image\|endswith: '\at.exe'`
			`CommandLine\|contains: 'interactive'`
Added Atomic Blue Detections Repo 2019-10-28 10:59:49 +00:00			`condition: selection`
OSCD QA wave 1 * Checked all rules against Mordor and EVTX samples datasets * Added field names * Some severity adjustments * Fixes 2020-01-10 23:11:27 +00:00			`fields:`
			`- ComputerName`
			`- User`
			`- CommandLine`
Added Atomic Blue Detections Repo 2019-10-28 10:59:49 +00:00			`falsepositives:`
Update win_interactive_at.yml 2019-11-11 01:05:21 +00:00			`- Unlikely (at.exe deprecated as of Windows 8)`
Added Atomic Blue Detections Repo 2019-10-28 10:59:49 +00:00			`level: high`