EXPLORE
← Back to Explore
T1053.002

At

Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) utility exists as an executable within Windows, Linux, and macOS for scheduling tasks at a specified time and date. Although deprecated in favor of [Scheduled Task](https://attack.mitre.org/techniques/T1053/005)'s [schtasks](https://attack.mitre.org/software/S0111) in Windows environments...

WindowsLinuxmacOS
17
Detections
3
Sources
3
Threat Actors

BY SOURCE

8sigma5elastic4splunk_escu

PROCEDURES (12)

Privilege2 detections

Auto-extracted: 2 detections for privilege

Ransomware2 detections

Auto-extracted: 2 detections for ransomware

Container2 detections

Auto-extracted: 2 detections for container

Scheduled Task2 detections

Auto-extracted: 2 detections for scheduled task

Api2 detections

Auto-extracted: 2 detections for api

Persist1 detections

Auto-extracted: 1 detections for persist

Persist1 detections

Auto-extracted: 1 detections for persist

Scheduled Task1 detections

Auto-extracted: 1 detections for scheduled task

Lateral1 detections

Auto-extracted: 1 detections for lateral

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Lateral1 detections

Auto-extracted: 1 detections for lateral

DETECTIONS (17)