Linux at/atd Process Execution via /at or /atd
Flags execution of /at or /atd on Linux, indicating scheduled job creation via at scheduling utilities.
FreeReviewedSigma · Low · v3
- Product
- linux
- Category
- process_creation
- Author
- Ömer Günal, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-06
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process execution where the binary path ends with /at or /atd on Linux. at/atd are used to schedule commands for later execution, and attackers may leverage them to run malicious payloads at a scheduled time for persistence or repeated execution. Detection relies on process creation telemetry that includes the executing image path.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-at-atd-process-execution-for-scheduled-job-creation-d2d642d7
title: Linux at/atd Process Execution via /at or /atd
id: c5abca61-9c5f-4bbe-8321-156ba1f08f82
status: stable
description: This rule identifies process execution where the binary path ends with /at or /atd on Linux. at/atd are used to schedule commands for later execution, and attackers may leverage them to run malicious payloads at a scheduled time for persistence or repeated execution. Detection relies on process creation telemetry that includes the executing image path.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.002/T1053.002.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_at_command.yml
author: Ömer Günal, oscd.community, Huntrule Team
date: 2020-10-06
modified: 2022-07-07
tags:
- attack.privilege-escalation
- attack.execution
- attack.persistence
- attack.t1053.002
logsource:
product: linux
category: process_creation
detection:
selection:
Image|endswith:
- /at
- /atd
condition: selection
falsepositives:
- Legitimate administration activities
level: low
license: DRL-1.1
related:
- id: d2d642d7-b393-43fe-bae4-e81ed5915c4b
type: derived