Remote Task Creation via ATSVC Named Pipe - Zeek

calendar Oct 23, 2025 · attack.privilege-escalation attack.execution attack.lateral-movement attack.persistence car.2013-05-004 car.2015-04-001 attack.t1053.002  ·
Share on: linkedin copy

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Sigma rule (View on GitHub)

 1title: Remote Task Creation via ATSVC Named Pipe - Zeek
 2id: dde85b37-40cd-4a94-b00c-0b8794f956b5
 3related:
 4    - id: f6de6525-4509-495a-8a82-1f8b0ed73a00
 5      type: derived
 6status: test
 7description: Detects remote task creation via at.exe or API interacting with ATSVC namedpipe
 8references:
 9    - https://web.archive.org/web/20230409194125/https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html
10author: 'Samir Bousseaden, @neu5rn'
11date: 2020-04-03
12modified: 2022-12-27
13tags:
14    - attack.privilege-escalation
15    - attack.execution
16    - attack.lateral-movement
17    - attack.persistence
18    - car.2013-05-004
19    - car.2015-04-001
20    - attack.t1053.002
21logsource:
22    product: zeek
23    service: smb_files
24detection:
25    selection:
26        path: '\\\*\IPC$'
27        name: 'atsvc'
28        # Accesses: '*WriteData*'
29    condition: selection
30falsepositives:
31    - Unknown
32level: medium

References

Related rules

to-top