title: Scheduled Task/Job At
id: d2d642d7-b393-43fe-bae4-e81ed5915c4b
status: stable
description: Detects the use of at/atd
author: Ömer Günal, oscd.community
date: 2020/10/06
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.001/T1053.001.md
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        ProcessName|endswith:
          - '/at'
          - '/atd'
    condition: selection
falsepositives:
    - Legitimate administration activities
level: low
tags:
    - attack.persistence
    - attack.t1053.001