LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

At.exe

View source

Schedule periodic tasks

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
03DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1053.002

Create a recurring task to execute every day at a specific time.

COMMAND
C:\Windows\System32\at.exe 09:00 /interactive /every:m,t,w,th,f,s,su {CMD}
USE CASE
Create a recurring task, to eg. to keep reverse shell session(s) alive
PRIVILEGES
Local Admin
OPERATING SYSTEM
Windows 7 or older
Execute · CMD
02 / ON DISK

Known paths

C:\WINDOWS\System32\At.exe
C:\WINDOWS\SysWOW64\At.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources

Indicators & detection notes

  • IOC

    C:\Windows\System32\Tasks\At1 (substitute 1 with subsequent number of at job)

  • IOC

    C:\Windows\Tasks\At1.job

  • IOC

    Registry Key - Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\At1.

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Freddie Barr-Smith
Riccardo Spolaor
Mariano Graziano
Xabier Ugarte-Pedrero