rules/linux/process_creation/at_command.yml

title: Scheduled Task/Job At
id: d2d642d7-b393-43fe-bae4-e81ed5915c4b
status: stable
description: Detects the use of at/atd
author: Ömer Günal, oscd.community
date: 2020/10/06
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.001/T1053.001.md
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith:
          - '/at'
          - '/atd'
    condition: selection
falsepositives:
    - Legitimate administration activities
level: low
tags:
    - attack.persistence
    - attack.t1053.001
Update at_command.yml 2020-10-07 00:07:30 +03:00			`title: Scheduled Task/Job At`
Create at_command.yml 2020-10-06 23:48:25 +03:00			`id: d2d642d7-b393-43fe-bae4-e81ed5915c4b`
			`status: stable`
			`description: Detects the use of at/atd`
Update at_command.yml 2020-10-07 22:22:31 +03:00			`author: Ömer Günal, oscd.community`
Create at_command.yml 2020-10-06 23:48:25 +03:00			`date: 2020/10/06`
			`references:`
Update at_command.yml 2020-10-16 10:56:06 +03:00			`- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.001/T1053.001.md`
Create at_command.yml 2020-10-06 23:48:25 +03:00			`logsource:`
			`product: linux`
Update at_command.yml 2020-10-16 22:49:40 +03:00			`category: process_creation`
Create at_command.yml 2020-10-06 23:48:25 +03:00			`detection:`
Update at_command.yml 2020-10-07 22:23:48 +03:00			`selection:`
Updated at command rule to use Image field 2021-10-15 15:46:59 -04:00			`Image\|endswith:`
Update at_command.yml 2020-10-16 22:49:40 +03:00			`- '/at'`
			`- '/atd'`
Update at_command.yml 2020-10-07 22:23:48 +03:00			`condition: selection`
Create at_command.yml 2020-10-06 23:48:25 +03:00			`falsepositives:`
			`- Legitimate administration activities`
			`level: low`
			`tags:`
			`- attack.persistence`
Update at_command.yml 2020-10-07 22:22:31 +03:00			`- attack.t1053.001`