Scheduled Task/Job: At (Linux)

Adversaries may abuse the at utility to perform task scheduling for initial or recurring execution of malicious code. The at command within Linux operating systems enables administrators to schedule tasks.[1]

An adversary may use at in Linux environments to execute programs at system startup or on a scheduled basis for persistence. at can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account.

ID: T1053.001
Sub-technique of:  T1053
Tactics: Execution, Persistence, Privilege Escalation
Platforms: Linux
Data Sources: Process command-line parameters, Process monitoring
Supports Remote:  Yes
Version: 1.0
Created: 03 December 2019
Last Modified: 23 March 2020

Mitigations

Mitigation Description
Audit

Scheduled tasks using at can be audited locally, or through centrally collected logging, using syslog, or auditd events from the host. [1]

User Account Management

Users account-level access to at can be managed using /etc/at.allow and /etc/at.deny files. Users listed in the at.allow are enabled to schedule actions using at, whereas users listed in at.deny file disabled from the utility.

Detection

Monitor scheduled task creation using command-line invocation. Legitimate scheduled tasks may be created during installation of new software or through system administration functions. Look for changes to tasks that do not correlate with known software, patch cycles, etc.

Suspicious program execution through scheduled tasks may show up as outlier processes that have not been seen before when compared against historical data. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

References