Possible Scheduled Task/Job At (via process_creation)

title: Possible Scheduled Task/Job At (via process_creation)
id: f13564a8-aecb-5f01-b466-3dc47db7e611
status: stable
description: This rule detects the use of at/atd which are utilities that are leveraged to schedule tasks. They are frequently misused by threat actors to maintain persistence or to perform task scheduling for initial or recurring execution of hostile code
references:
    - https://attack.mitre.org/techniques/T1053/002/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.002/T1053.002.md
author: Huntrule Team
date: 2026-04-15
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.002
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '/at'
            - '/atd'
    condition: selection
falsepositives:
    - Unknown
level: low