---
attack_technique: T1053.002
display_name: 'Scheduled Task/Job: At (Windows)'

atomic_tests:
- name: At.exe Scheduled task
  auto_generated_guid: 4a6c0dc4-0f2a-4203-9298-a5a9bdc21ed8
  description: |
    Executes cmd.exe
    Note: deprecated in Windows 8+

    Upon successful execution, cmd.exe will spawn at.exe and create a scheduled task that will spawn cmd at a specific time.
  supported_platforms:
    - windows
  executor:
    name: command_prompt
    elevation_required: false
    command: |
      at 13:20 /interactive cmd
