Detection of Interactive AT Job Scheduled Tasks

The 'at.exe' utility is a legacy Windows command-line tool used to schedule tasks, which was deprecated in Windows 8 and Windows Server 2012 in favor of the 'schtasks' utility. Despite its deprecation, attackers frequently abuse 'at.exe' to execute commands or binaries with SYSTEM-level privileges by using the 'interactive' flag. Because 'at.exe' creates jobs that run under the context of the SYSTEM account, this technique provides an effective path for privilege escalation if an attacker has already obtained administrative access to the system. Monitoring for the execution of 'at.exe' is highly effective for modern environments, as the tool is rarely required for legitimate administrative workflows on current Windows operating systems.

Attack Chain

1. Attacker gains administrative access to a Windows endpoint.
2. Attacker prepares a malicious binary or script to be executed.
3. Attacker uses the 'at.exe' command-line tool to schedule a new task.
4. The command includes the 'interactive' flag to ensure the process interacts with the desktop session.
5. The task is registered as a SYSTEM job within the Windows task scheduler infrastructure.
6. The operating system triggers the job at the specified time.
7. The scheduled process executes with NT AUTHORITY\SYSTEM privileges.
8. Attacker achieves elevated command execution or persistence on the host.

Impact

Successful exploitation results in unauthorized code execution with elevated SYSTEM privileges, allowing an attacker to bypass security controls, install persistent backdoors, or exfiltrate sensitive data from the targeted host.

Recommendation

Detection engineering teams should prioritize the deployment of the provided Sigma rule to monitor for any invocation of 'at.exe'. Given the tool's deprecation, any execution should be treated as highly suspicious.

• Deploy the Sigma rule below to your SIEM and tune for your environment to identify legacy task scheduling activity.
• Audit systems for the presence of the 'at.exe' binary and consider removing or restricting access to it via AppLocker or Windows Defender Application Control (WDAC).
• Investigate any alerts generated by this rule immediately, as it represents either an attempt at persistence or privilege escalation.