Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40 detections
Filters
Last updated
All Time
Detection languages
17
9
8
2
2
Contributors
14
7
6
5
4
Categories
25
17
15
6
3
Platforms
32
9
3
Products / Services
13
11
6
6
4
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
1
IDS Protocols
1
1
Detects the use of 'at' or 'atd' utilities, which are commonly abused by adversaries for persistence or to schedule the execution of malicious code. This rule specifically looks for the execution of '/at' or '/atd' binaries.
Detects the creation of an interactive AT job, which can be used for privilege escalation or persistence. The rule specifically looks for the execution of 'at.exe' with the 'interactive' command-line argument.
Detects remote RPC calls to create or execute a scheduled task via SASec
Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE
Detects remote task creation via at.exe or API interacting with ATSVC namedpipe
Detects remote task creation via at.exe or API interacting with ATSVC namedpipe
Detects remote RPC calls to create or execute a scheduled task via ATSvc
Detects remote RPC calls to create or execute a scheduled task
Detects the use of at/atd which are utilities that are used to schedule tasks.
They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code
They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code
The following analytic detects the creation of scheduled tasks on remote Windows endpoints using the at.exe command. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process creation events involving at.exe with remote command-line arguments. Identifying this activity is significant for a SOC as it may indicate lateral movement or remote code execution attempts by an attacker. If confirmed malicious, this activity could lead to unauthorized access, persistence, or execution of malicious code, potentially resulting in data theft or further compromise of the network.
Interactive AT Job
Sigma
Detects an interactive AT job, which may be used as a form of privilege escalation.
Detects remote task creation via at.exe or API interacting with ATSVC namedpipe
Interactive AT Job
Sigma
Detects an interactive AT job, which may be used as a form of privilege escalation.
The following analytic detects the execution of the "At" application in Linux, which can be used by attackers to create persistence entries on a compromised host. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent process names associated with "at" or "atd". This activity is significant because the "At" application can be exploited to maintain unauthorized access or deliver additional malicious payloads. If confirmed malicious, this behavior could lead to data theft, ransomware attacks, or other severe consequences. Immediate investigation is required to determine the legitimacy of the execution and mitigate potential risks.
The following analytic detects the creation of a new DWORD value named "EnableAt" in the registry path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration". This modification enables the use of the at.exe or wmi Win32_ScheduledJob commands to add scheduled tasks on a Windows endpoint. The detection leverages registry event data from the Endpoint datamodel. This activity is significant because it may indicate that an attacker is enabling the ability to schedule tasks, potentially to execute malicious code at specific times or intervals. If confirmed malicious, this could allow persistent code execution on the system.
The analytic detects the creation of the /etc/at.allow or /etc/at.deny configuration files in Linux. These files control user permissions for the "at" scheduling application and can be abused by attackers to establish persistence. If confirmed malicious, this could allow unauthorized execution of malicious code, leading to potential data theft or further system compromise. Analysts should review the file path, creation time, and associated processes to assess the threat.
The following analytic detects the execution of the "At" application in Linux, which can be used by attackers to create persistence entries on a compromised host. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent process names associated with "at" or "atd". This activity is significant because the "At" application can be exploited to maintain unauthorized access or deliver additional malicious payloads. If confirmed malicious, this behavior could lead to data theft, ransomware attacks, or other severe consequences. Immediate investigation is required to determine the legitimacy of the execution and mitigate potential risks.
The analytic detects suspicious command lines that append user entries to `/etc/at.allow` or `/etc/at.deny` files on Linux systems. This activity is significant because altering these configuration files can allow attackers to schedule tasks with elevated permissions, facilitating persistence on a compromised Linux host. If confirmed malicious, this could enable attackers to execute arbitrary code at scheduled intervals, potentially leading to further system compromise and unauthorized access to sensitive information. The rule specifically looks for `echo` commands writing to these files.
Interactive AT Job
Sigma
Detects an interactive AT job, which may be used as a form of privilege escalation.
Page 2 of 2