Query: detection rule: Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to m
Matching passage: Sigma rule: Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to m. Logsource: linux / process_creation. Rule: title: Scheduled Task/Job At id: d2d642d7-b393-43fe-bae4-e81ed5915c4b status: stable description: 'Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.002/T1053.002.md author: Ömer Günal, oscd.community date: 2020-10-06 modified: 2022-07-07 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.002 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /at - /atd condition: selection falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: Wow6432Node CurrentVersion Autorun Keys Modification id: b29aed60-ebd1-442b-9cb5-16a1d0324adb related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d - https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/ author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2025-12-08 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_wow_current_version_base: TargetObject|contains: \SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion selection_wow_current_version_keys: TargetObject|contains: - \ShellServiceObjectDelayLoad - \Run\ - \RunOnce\ - \RunOnceEx\ - \RunServices\ - \RunServicesOnce\ - \Explorer\ShellServiceObjects - \Explorer\ShellIconOverlayIdentifiers - \Explorer\ShellExecuteHooks - \Explorer\SharedTaskScheduler - \Explorer\Browser Helper Objects filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_ms_win_desktop_runtime: Details|startswith: '"C:\ProgramData\Package Cache\{d21a4f20-968a-4b0c-bf04-a38da5f06e41}\windowsdesktop-runtime-' filter_main_vcredist: Image|endswith: \VC_redist.x64.exe Details|endswith: '}\VC_redist.x64.exe" /burn.runonce' filter_main_upgrades: Image|startswith: - C:\ProgramData\Package Cache - C:\Windows\Temp\ Image|contains: - \winsdksetup.exe - \windowsdesktop-runtime- - \AspNetCoreSharedFrameworkBundle- Details|endswith: ' /burn.runonce' filter_main_uninstallers: Image|startswith: C:\Windows\Installer\MSI TargetObject|contains: \Explorer\Browser Helper Objects filter_main_msiexec: Image: C:\WINDOWS\system32\msiexec.exe TargetObject|contains: \SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ filter_main_edge: Image|contains|all: - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ - \setup.exe filter_optional_msoffice1: Image: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe TargetObject|contains: \Office\ClickToRun\REGISTRY\MACHINE\Software\Wow64