attack.t1053.002

Interactive AT Job

Aug 12, 2024 · attack.privilege-escalation attack.t1053.002 ·

Detects an interactive AT job, which may be used as a form of privilege escalation.

MITRE BZAR Indicators for Execution

Aug 12, 2024 · attack.execution attack.t1047 attack.t1053.002 attack.t1569.002 ·

Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE

Remote Schedule Task Lateral Movement via ATSvc

Aug 12, 2024 · attack.lateral-movement attack.t1053 attack.t1053.002 ·

Share on:

Detects remote RPC calls to create or execute a scheduled task via ATSvc

Remote Schedule Task Lateral Movement via ITaskSchedulerService

Aug 12, 2024 · attack.lateral-movement attack.t1053 attack.t1053.002 ·

Share on:

Detects remote RPC calls to create or execute a scheduled task

Remote Schedule Task Lateral Movement via SASec

Aug 12, 2024 · attack.lateral-movement attack.t1053 attack.t1053.002 ·

Share on:

Detects remote RPC calls to create or execute a scheduled task via SASec

Remote Task Creation via ATSVC Named Pipe

Aug 12, 2024 · attack.lateral-movement attack.persistence car.2013-05-004 car.2015-04-001 attack.t1053.002 ·

Share on:

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Remote Task Creation via ATSVC Named Pipe - Zeek

Aug 12, 2024 · attack.lateral-movement attack.persistence car.2013-05-004 car.2015-04-001 attack.t1053.002 ·

Share on:

Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Scheduled Task/Job At

Aug 12, 2024 · attack.persistence attack.t1053.002 ·

Share on:

Detects the use of at/atd which are utilities that are used to schedule tasks. They are often abused by adversaries to maintain persistence or to perform task scheduling for initial or recurring execution of malicious code

Atexec.py Execution

Mar 26, 2024 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·

Share on:

This detection analytic identifies Impacket’s atexec.py script on a target host. atexec.py is remotely run on an adversary’s machine to execute commands on the victim via scheduled task. The command is commonly executed by a non-interactive cmd.exe with the output redirected to an eight-character TMP file. Part of the RedCanary 2024 Threat Detection Report.

Impacket AtExec Process Activity

Apr 16, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·

Share on:

Detect Atexec.py (Impacket) usage to send command output to attacker.

Impacket AtExec Suspicious Registry Modification

Jan 30, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·

Share on:

Detects Atexec.py (Impacket) suspicious registry key addition.

Impacket AtExec Suspicious Temp File Creation

Jan 30, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·

Share on:

Detects Atexec.py (Impacket) suspicious file creation in Windows temp directory.

Possible Impacket AtExec Activity

Jan 30, 2023 · attack.s0357 attack.execution attack.t1053 attack.t1053.002 ·

Share on:

Detect Impacket atexec.py usage in Windows task scheduler logs. If detected, these events will appear to be logged simultaneously and will all contain the same eight-letter task name.