LoFP / unlikely (at.exe deprecated as of windows 8)

Techniques

• t1053
• t1053.002

Sample rules

Interactive AT Job

• source: sigma
• technicques:
  • t1053
  • t1053.002

Description

Detects an interactive AT job, which may be used as a form of privilege escalation.

Detection logic

condition: selection
selection:
  CommandLine|contains: interactive
  Image|endswith: \at.exe