Interactive AT Job Creation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•22

Detects the creation of an interactive AT job, which can be used for privilege escalation or persistence. The rule specifically looks for the execution of 'at.exe' with the 'interactive' command-line argument.