Sigma low stable sigma

Scheduled Task/Job At

Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code

View Source

Detection Logic

{
  "selection": {
    "Image
| endswith": [
      "/at",
      "/atd"
    ]
  },
  "condition": "selection"
}

False Positives

⚠ Legitimate administration activities

Field Validations

Loading…

Comments (0)

Loading comments...