mdecrevoisier high experimental sigma

Interactive privileged shell triggered by schedule task (deprecated)

Detects scenarios where an attacker abuse the at command to elevate privilages. Note that at command is deprecated since Windows 8 and replaced by schtask.

View Source

Detection Logic

{
  "selection": {
    "EventID": 4688,
    "NewProcessName
| endswith": "\\cmd.exe",
    "CommandLine
| contains
| all": [
      "at",
      "interactive",
      "cmd"
    ]
  },
  "condition": "selection"
}

False Positives

⚠ None

Field Validations

Loading…

Comments (0)

Loading comments...