Windows Scheduled Tasks AT Command Enabled via Registry Modification

The Windows AT command, a legacy task scheduler, has been deprecated since Windows 8 and Windows Server 2012, yet remains for backward compatibility. Attackers can abuse this command to schedule malicious tasks for local persistence or lateral movement. This involves modifying the registry to enable the AT command, specifically targeting the EnableAt value. Successful exploitation allows adversaries to execute commands or programs at specified times, even after a system reboot. This threat is relevant because it leverages a legitimate, but outdated, system feature to bypass modern security controls.

Attack Chain

1. An attacker gains initial access to a Windows system through some means (e.g., compromised credentials, software vulnerability).
2. The attacker attempts to modify the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration.
3. Specifically, the attacker changes the EnableAt value within the registry key.
4. The attacker sets the EnableAt value to "1" or "0x00000001" to enable the AT command.
5. The attacker uses the at command to schedule a malicious task to execute at a specific time.
6. The scheduled task executes, potentially running a malicious script or program.
7. This can lead to persistence, where the malicious task is re-executed after a reboot, or lateral movement, where the attacker uses the compromised system to access other systems on the network.

Impact

Enabling the AT command allows attackers to schedule malicious tasks, leading to persistent access, privilege escalation, or lateral movement within the network. While the exact number of victims is unknown, successful exploitation can lead to significant data breaches, system compromise, and disruption of services. This is especially critical in environments where legacy applications rely on the AT command for task scheduling.

Recommendation

• Deploy the Sigma rule Detect AT Command Enablement via Registry to detect registry modifications related to enabling the AT command and tune for your environment.
• Monitor process creation events for usage of the at command, focusing on unusual or unexpected processes spawned by it.
• Regularly review and audit scheduled tasks to identify and remove any suspicious entries created by the at command.
• Disable the AT command completely if it is not required for legitimate business purposes.