{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/schedule-task/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["linux","persistence","schedule-task","edr"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe 'at' and 'atd' utilities in Linux environments are legitimate tools designed for scheduling tasks to run at specific future times. Threat actors frequently abuse these utilities to establish persistence or facilitate privilege escalation on compromised hosts. By leveraging the 'at' daemon, an attacker can ensure that malicious payloads, backdoors, or system modifications execute automatically without requiring further interaction. This behavior is particularly dangerous as it operates within the context of system automation, often blending in with standard administrative operations. Defenders should focus on monitoring the execution of 'at' or 'atd' binaries, especially when invoked by unusual parent processes or unexpected user accounts. Because these utilities are common, effective detection requires distinguishing between legitimate system automation and anomalous usage patterns that deviate from established baselines.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial access is gained on the Linux host (e.g., via web shell or exploitation of a service).\u003c/li\u003e\n\u003cli\u003eThe attacker identifies the presence of the 'at' or 'atd' utility on the target system.\u003c/li\u003e\n\u003cli\u003eThe attacker writes a malicious payload or script to a temporary directory (e.g., /tmp).\u003c/li\u003e\n\u003cli\u003eThe attacker uses the 'at' command to schedule the execution of the malicious script at a future time.\u003c/li\u003e\n\u003cli\u003eThe 'atd' daemon manages the job queue and monitors the system clock.\u003c/li\u003e\n\u003cli\u003eUpon reaching the scheduled time, the 'atd' daemon executes the script with the privileges of the user who scheduled the job.\u003c/li\u003e\n\u003cli\u003eThe malicious script runs, providing the attacker with persistent access or elevated command execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful abuse of the 'at' utility can lead to long-term persistence, unauthorized lateral movement, and privilege escalation. If left undetected, this mechanism allows attackers to maintain a foothold on critical infrastructure, facilitating ongoing data theft, potential ransomware deployment, or unauthorized system configuration changes.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to monitor for 'at' or 'atd' process creation across all Linux endpoints.\u003c/li\u003e\n\u003cli\u003eEstablish a baseline of known-good administrative automation scripts that use the 'at' utility to reduce false positives.\u003c/li\u003e\n\u003cli\u003eImplement strict process execution logging via Sysmon for Linux or equivalent EDR telemetry, focusing on the parent process of 'at' and 'atd' invocations.\u003c/li\u003e\n\u003cli\u003eAudit scheduled jobs periodically to identify and remove unauthorized or suspicious entries.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"rules\"\u003eRules\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003etitle: \u0026quot;Detect Linux At Application Execution\u0026quot;\ndescription: \u0026quot;Detects the execution of the 'at' or 'atd' applications which can be used to schedule malicious tasks for persistence.\u0026quot;\nlogsource:\ncategory: \u0026quot;process_creation\u0026quot;\nproduct: \u0026quot;linux\u0026quot;\ndetection:\nselection:\nImage|endswith:\u003c/li\u003e\n\u003cli\u003e\u0026quot;/at\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;/atd\u0026quot;\nParentImage|endswith:\u003c/li\u003e\n\u003cli\u003e\u0026quot;/at\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;/atd\u0026quot;\ncondition: selection\nlevel: \u0026quot;medium\u0026quot;\ntags:\u003c/li\u003e\n\u003cli\u003e\u0026quot;attack.persistence\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;attack.privilege-escalation\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;attack.t1053.002\u0026quot;\ntests:\npositive:\u003c/li\u003e\n\u003cli\u003ename: \u0026quot;Direct execution of at utility\u0026quot;\ndata:\u003c/li\u003e\n\u003cli\u003eImage: \u0026quot;/usr/bin/at\u0026quot;\nParentImage: \u0026quot;/usr/bin/bash\u0026quot;\nnegative:\u003c/li\u003e\n\u003cli\u003ename: \u0026quot;Common system process\u0026quot;\ndata:\u003c/li\u003e\n\u003cli\u003eImage: \u0026quot;/usr/bin/sshd\u0026quot;\nParentImage: \u0026quot;/usr/bin/systemd\u0026quot;\nfalsepositives:\u003c/li\u003e\n\u003cli\u003e\u0026quot;Legitimate administrative tasks scheduled by operators or existing automation scripts.\u0026quot;\nhandoff:\ndetection_confidence: \u0026quot;medium\u0026quot;\nrequired_telemetry:\u003c/li\u003e\n\u003cli\u003elog_source: \u0026quot;Sysmon for Linux\u0026quot;\nevent_or_channel: \u0026quot;Event ID 1\u0026quot;\nrequired_fields:\u003c/li\u003e\n\u003cli\u003e\u0026quot;Image\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;ParentImage\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;CommandLine\u0026quot;\navailability: \u0026quot;available\u0026quot;\nnotes: \u0026quot;Requires Sysmon for Linux or equivalent EDR process auditing.\u0026quot;\nvalidation:\nstatus: \u0026quot;needs_environment_validation\u0026quot;\nsteps:\u003c/li\u003e\n\u003cli\u003e\u0026quot;Run 'echo \u0026quot;id\u0026quot; | at now + 1 minute' in a controlled lab environment.\u0026quot;\nexpected_telemetry: \u0026quot;Sysmon Event ID 1 showing /usr/bin/at execution.\u0026quot;\npass_criteria: \u0026quot;Detection rule identifies the 'at' process.\u0026quot;\natomic_reference: \u0026quot;Atomic Red Team T1053.002\u0026quot;\ntuning:\u003c/li\u003e\n\u003cli\u003esource: \u0026quot;Automation scripts\u0026quot;\nguidance: \u0026quot;Filter based on known service accounts or parent process paths that are part of legitimate maintenance.\u0026quot;\nsuggested_owner: \u0026quot;Detection Engineering\u0026quot;\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T17:47:15Z","date_published":"2026-10-12T17:47:15Z","id":"https://feed.craftedsignal.io/briefs/2026-10-linux-at-persistence/","summary":"Attackers can abuse the Linux 'at' or 'atd' utilities to maintain unauthorized access or escalate privileges by scheduling malicious tasks.","title":"Detection of Linux 'At' Utility Abuse for Persistence","url":"https://feed.craftedsignal.io/briefs/2026-10-linux-at-persistence/"}],"language":"en","title":"CraftedSignal Threat Feed - Schedule-Task","version":"https://jsonfeed.org/version/1.1"}