Remote AT Scheduled Job Creation

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects attempts to create scheduled jobs remotely using the 'atsvc' service, typically associated with the Windows Task Scheduler. It specifically looks for TCP traffic on port 445 (SMB) containing the string 'atsvc' in an established flow to the home network. This activity can be indicative of an adversary establishing persistence or executing code remotely.