tool

at S0110

Type: tool
Platforms: Linux, Windows, macOS
Created: 31 May 2017
Last modified: 16 April 2025

at is used to schedule tasks on a system to run at a specified date or time.[1][2]

TechniqueBottom 5%

TacticsBottom 21%

Threat groupsunranked

Campaignunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

at MITRE reference S0110

At T1053.002 ↗

at can be used to schedule a task on a system to be executed at a specific date or time.3 4

Execution · Persistence · Privilege Escalation12 detection rules

Standing S0110

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Technique1Bottom 5%

5th percentile · 95% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics3Bottom 21%

21st percentile · 79% of 825 ATT&CK software entries have more tactics spanned.

Threat groups361% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaign185% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique12medBottom 22%

22nd percentile · 78% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique3med

at detections S0110

12 distinct rules cover the 1 technique recorded for this tool. 8 Sigma · 4 Splunk.

1 covered by at least one rule12 distinct rules in total

Showing 1-12 of 12 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects an interactive AT job, which may be used as a form of privilege escalation.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job At	-	high	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	2019-10-24	2021-11-27	60fc936d-2eb0-4543-8a13-911c750a1dfc
Splunk	The following analytic detects the execution of the "At" application in Linux, which can be used by attackers to create persistence entries on a compromised host. (...)	Anomaly	stable	process_creation	linux	Sysmon	Execution, Persistence, Privilege Escalation Scheduled Task/Job At	-	medium	Teoderick Contreras, Bhavin Patel, Splunk	2021-12-21	2026-10-09	bf0a378e-5f3c-11ec-a6de-acde48001122
Splunk	The following analytic detects the execution of the "At" application in Linux, which can be used by attackers to create persistence entries on a compromised host. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Execution, Persistence, Privilege Escalation Scheduled Task/Job At	-	medium	Teoderick Contreras, Splunk	2021-12-21	2026-05-13	9f306e0a-1c36-469e-8892-968ca12470dd
Splunk	The following analytic detects suspicious command lines that append user entries to /etc/at.allow or /etc/at.deny files. (...)	Anomaly	stable	process_creation	linux	Sysmon	Execution, Persistence, Privilege Escalation Scheduled Task/Job At	-	medium	Teoderick Contreras, Splunk	2021-12-21	2026-05-13	7bc20606-5f40-11ec-a586-acde48001122
	Windows DCE-RPC functions which indicate an execution techniques on the remote system. (...)	Generic	test	-	-	DCE/RPC · Zeek	Execution, Persistence, Privilege Escalation Scheduled Task/Job At Execution System Services Service Execution Execution Windows Management Instrumentation	-	medium	@neu5ron, SOC Prime	2020-03-19	2021-11-27	b640c0b8-87f8-4daa-aef8-95a24261dd1d
	Detects remote RPC calls to create or execute a scheduled task via ATSvc	Generic	test	-	-	RPC Firewall	Execution, Persistence, Privilege Escalation Scheduled Task/Job At	-	high	Sagie Dulce, Dekel Paz	2022-01-01	—	0fcd1c79-4eeb-4746-aba9-1b458f7a79cb
	Detects remote RPC calls to create or execute a scheduled task	Generic	test	-	-	RPC Firewall	Execution, Persistence, Privilege Escalation Scheduled Task/Job At	-	high	Sagie Dulce, Dekel Paz	2022-01-01	—	ace3ff54-e7fd-46bd-8ea0-74b49a0aca1d
	Detects remote RPC calls to create or execute a scheduled task via SASec	Generic	test	-	-	RPC Firewall	Execution, Persistence, Privilege Escalation Scheduled Task/Job At	-	high	Sagie Dulce, Dekel Paz	2022-01-01	—	aff229ab-f8cd-447b-b215-084d11e79eb0
	Detects remote task creation via at.exe or API interacting with ATSVC namedpipe	Generic	test	network_connection	windows	WinEventLog Security	Execution, Persistence, Privilege Escalation Scheduled Task/Job At	-	medium	Samir Bousseaden	2019-04-03	2024-08-01	f6de6525-4509-495a-8a82-1f8b0ed73a00
	Detects remote task creation via at.exe or API interacting with ATSVC namedpipe	Generic	test	-	-	SMB · Zeek	Execution, Persistence, Privilege Escalation Scheduled Task/Job At	-	medium	Samir Bousseaden, @neu5rn	2020-04-03	2022-12-27	dde85b37-40cd-4a94-b00c-0b8794f956b5
Splunk	The following analytic detects the creation of scheduled tasks on remote Windows endpoints using the at.exe command. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution, Persistence, Privilege Escalation Scheduled Task/Job At	-	medium	Mauricio Velazco, Splunk	2021-11-11	2026-05-13	4be54858-432f-11ec-8209-3e22fbd008af
	Detects the use of at/atd which are utilities that are used to schedule tasks. (...)	Generic	stable	process_creation	linux	Sysmon	Execution, Persistence, Privilege Escalation Scheduled Task/Job At	-	low	Ömer Günal, oscd.community	2020-10-06	2022-07-07	d2d642d7-b393-43fe-bae4-e81ed5915c4b

Standing S0110

Title

Description