# T1053.001 - At (Linux)
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1053/001)
<blockquote>Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) command within Linux operating systems enables administrators to schedule tasks.(Citation: Kifarunix - Task Scheduling in Linux)

An adversary may use [at](https://attack.mitre.org/software/S0110) in Linux environments to execute programs at system startup or on a scheduled basis for persistence. [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account.</blockquote>

## Atomic Tests

- [Atomic Test #1 - At - Schedule a job](#atomic-test-1---at---schedule-a-job)


<br/>

## Atomic Test #1 - At - Schedule a job
This test submits a command to be run in the future by the `at` daemon.

**Supported Platforms:** Linux


**auto_generated_guid:** 7266d898-ac82-4ec0-97c7-436075d0d08e





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| time_spec | Time specification of when the command should run | String | now + 1 minute|
| at_command | The command to be run | String | echo Hello from Atomic Red Team|


#### Attack Commands: Run with `sh`! 


```sh
echo "#{at_command}" | at #{time_spec}
```




#### Dependencies:  Run with `sh`!
##### Description: The `at` and `atd` executables must exist in the PATH
##### Check Prereq Commands:
```sh
which at && which atd
```
##### Get Prereq Commands:
```sh
echo 'Please install `at` and `atd`; they were not found in the PATH (Package name: `at`)'
```
##### Description: The `atd` daemon must be running
##### Check Prereq Commands:
```sh
systemctl status atd || service atd status
```
##### Get Prereq Commands:
```sh
echo 'Please start the `atd` daemon (sysv: `service atd start` ; systemd: `systemctl start atd`)'
```




<br/>
