TA0002 · EXECUTION
At
Adversaries may abuse the at utility to perform task scheduling for initial or recurring execution of malicious code. The at utility exists as an executable within Windows, Linux, and macOS for scheduling tasks at a specified time and date.
Detect it with
Monitor process execution from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows. If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete.
Why it matters on shift
At is one of the concrete ways adversaries achieve execution. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After execution, the next tactic is usually Persistence. Search your telemetry for the transition before closing the ticket.
Kill-chain context