title: Remote Task Creation via ATSVC Named Pipe - Zeek
id: dde85b37-40cd-4a94-b00c-0b8794f956b5
status: test
description: Detects remote task creation via at.exe or API interacting with ATSVC namedpipe
author: 'Samir Bousseaden, @neu5rn'
references:
  - https://github.com/neo23x0/sigma/blob/d42e87edd741dd646db946f30964f331f92f50e6/rules/windows/builtin/win_atsvc_task.yml
date: 2020/04/03
modified: 2021/11/27
logsource:
  product: zeek
  service: smb_files
detection:
  selection:
    path: \\\*\IPC$
    name: atsvc
        #Accesses: '*WriteData*'
  condition: selection
falsepositives:
  - Unknown
level: medium
tags:
  - attack.lateral_movement
  - attack.persistence
  - car.2013-05-004
  - car.2015-04-001
  - attack.t1053.002
