AN0943
Analytic 0943
Windows
Detects creation of scheduled tasks via `at.exe` or WMI `Win32_ScheduledJob` class, followed by execution of anomalous processes by svchost.exe or taskeng.exe.
WinEventLog:Security
EventCode=4698
WinEventLog:Sysmon
EventCode=1
[TaskUser]
Unusual users creating jobs (e.g., non-admin accounts or service users).
[ExecutionTimeWindow]
Delay between task registration and execution.
[CommandLinePattern]
Unexpected script or binary execution (e.g., cmd.exe /c PowerShell payload).
AN0944
Analytic 0944
Linux
Detects usage of `at` command to schedule jobs, followed by job execution and modification of job files under /var/spool/cron/atjobs.
auditd:SYSCALL
execve
auditd:SYSCALL
write
[AtJobPath]
Monitoring additional paths (e.g., tmp-mounted spool dirs) for modified at jobs.
[ScheduleLatency]
Expected delay between at job creation and execution.
[JobScriptEntropy]
High entropy or obfuscation in at job payloads.
AN0945
Analytic 0945
macOS
Detects user or root invocation of `at` command to schedule a job, followed by job execution using LaunchServices and activity in /usr/lib/cron/at.
macos:unifiedlog
process: at, job runner
fs:fsusage
file access to /usr/lib/cron/at and job execution path
macos:osquery
process_events
[AtPermissions]
Whether `at.allow` and `at.deny` are properly configured.
[ExecutionCommand]
Target binary executed via the at job.
[RunUser]
Detection of root user scheduling job with unusual command.