Elastic low stable eql
At.exe Command Lateral Movement
Identifies use of at.exe to interact with the task scheduler on remote hosts. Remote task creations, modifications or execution could be indicative of adversary lateral movement.
Detection Logic
process where host.os.type == "windows" and event.type == "start" and process.name : "at.exe" and process.args : "\\\\*"Field Validations
Loading…
Comments (0)
Loading comments...