Scheduled Task/Job At Utility Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•31

Detects the use of 'at' or 'atd' utilities, which are commonly abused by adversaries for persistence or to schedule the execution of malicious code. This rule specifically looks for the execution of '/at' or '/atd' binaries.