# T1053.002 - At (Windows)
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1053/002)
<blockquote>Adversaries may abuse the <code>at.exe</code> utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) utility exists as an executable within Windows for scheduling tasks at a specified time and date. Using [at](https://attack.mitre.org/software/S0110) requires that the Task Scheduler service be running, and the user to be logged on as a member of the local Administrators group. 

An adversary may use <code>at.exe</code> in Windows environments to execute programs at system startup or on a scheduled basis for persistence. [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account (such as SYSTEM).

Note: The <code>at.exe</code> command line utility has been deprecated in current versions of Windows in favor of <code>schtasks</code>.</blockquote>

## Atomic Tests

- [Atomic Test #1 - At.exe Scheduled task](#atomic-test-1---atexe-scheduled-task)


<br/>

## Atomic Test #1 - At.exe Scheduled task
Executes cmd.exe
Note: deprecated in Windows 8+

Upon successful execution, cmd.exe will spawn at.exe and create a scheduled task that will spawn cmd at a specific time.

**Supported Platforms:** Windows


**auto_generated_guid:** 4a6c0dc4-0f2a-4203-9298-a5a9bdc21ed8






#### Attack Commands: Run with `command_prompt`! 


```cmd
at 13:20 /interactive cmd
```






<br/>
