Linux at/atd Process Execution for Scheduled Job Creation

title: Linux at/atd Process Execution for Scheduled Job Creation
id: c5abca61-9c5f-4bbe-8321-156ba1f08f82
status: stable
description: This rule identifies process executions where the binary path ends with /at or /atd, indicating use of the at scheduling utilities. Attackers commonly abuse these tools to schedule initial or recurring command execution for persistence or deferred execution. The detection relies on Linux process creation telemetry, specifically the executed image path suffix.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.002/T1053.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_at_command.yml
author: Ömer Günal, oscd.community, Huntrule Team
date: 2020-10-06
modified: 2022-07-07
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.002
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - /at
      - /atd
  condition: selection
falsepositives:
  - Legitimate administration activities
level: low
license: DRL-1.1
related:
  - id: d2d642d7-b393-43fe-bae4-e81ed5915c4b
    type: derived