Detect job scheduling through the legacy at utility

1title: Detect job scheduling through the legacy at utility2id: e0ef56ca-da0b-4599-858e-8ac73495d6d23status: experimental4description: |5  MITRE's Windows analytic names two routes to the legacy job queue — running6  at.exe and driving the Win32_ScheduledJob WMI class — so the rule carries one7  selection for each: the image path for the binary, and two command-line forms8  of the class, the literal name as PowerShell and wmic path spell it plus the9  job call create form, because job is wmic's alias for Win32_ScheduledJob and10  that invocation never contains the class name. at.exe was deprecated in11  favour of schtasks more than a decade ago, which is what gives a bare12  execution event its value here; no command-line pattern is required, because13  on a modern estate the invocation itself is the anomaly and MITRE's14  CommandLinePattern knob is better used to rank matches than to gate them.15  Note that the WMI leg only sees the class named on a command line, so a16  compiled agent or implant calling Win32_ScheduledJob in-process is invisible17  to it, and the follow-on execution the analytic describes — an anomalous18  child of svchost.exe or taskeng.exe minutes later — is a timed correlation19  Sigma cannot express, so this rule is the scheduling step only. The logic is20  written in the Sysmon EventID 1 process_creation vocabulary; the strategy's21  other feed, Security 4698, needs the Audit Other Object Access Events22  subcategory enabled and carries the job definition in TaskContent rather than23  Image or CommandLine, so it cannot feed this rule without a field mapping24  first.25  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0333, not hand-written and not tested by its author. Any lab result is on this rule's own page.26references:27  - https://attack.mitre.org/techniques/T1053/00228  - https://attack.mitre.org/detectionstrategies/DET033329author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)30date: 2026-08-1631tags:32  - attack.execution33  - attack.persistence34  - attack.privilege-escalation35  - attack.t1053.00236logsource:37  category: process_creation38  product: windows39detection:40  selection_binary:41    Image|endswith: '\at.exe'42  selection_wmi:43    CommandLine|contains:44      - 'Win32_ScheduledJob'45      - ' job call create'46  condition: 1 of selection_*47falsepositives:48  - "Legacy in-house scripts and old third-party agents — backup, point-of-sale, imaging and industrial software written for XP or Server 2003 — that still schedule their own work with at rather than schtasks. Where one exists it runs on a schedule, so it re-alerts on the same host and account indefinitely until allow-listed."49  - "Administrator and helpdesk habit: at typed at an elevated prompt to list or clear the legacy queue. Running it with no arguments only prints the queue, but produces a process-creation event indistinguishable from one that schedules a job."50  - "Audit, inventory and compliance scanners that enumerate the legacy job queue by shelling out to at.exe or by querying Win32_ScheduledJob through wmic or PowerShell during a sweep — these match the WMI half of the rule on every host in scope, on every scan."51  - "Adversary-simulation and control-validation tooling such as Atomic Red Team, whose T1053.002 tests invoke at.exe exactly as the rule expects."52level: medium