T1053.001.md

T1053.001 - At (Linux)

Description from ATT&CK

Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial or recurring execution of malicious code. The [at](https://attack.mitre.org/software/S0110) command within Linux operating systems enables administrators to schedule tasks.(Citation: Kifarunix - Task Scheduling in Linux)

An adversary may use at in Linux environments to execute programs at system startup or on a scheduled basis for persistence. at can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account.

Atomic Tests

• Atomic Test #1 - At - Schedule a job

Atomic Test #1 - At - Schedule a job

This test submits a command to be run in the future by the at daemon.

Supported Platforms: Linux

Inputs:

Name	Description	Type	Default Value
time_spec	Time specification of when the command should run	String	now + 1 minute
at_command	The command to be run	String	echo Hello from Atomic Red Team

Attack Commands: Run with sh!

echo "#{at_command}" | at #{time_spec}

Dependencies: Run with sh!

Description: The at and atd executables must exist in the PATH

Check Prereq Commands:

which at && which atd 

Get Prereq Commands:

echo 'Please install `at` and `atd`; they were not found in the PATH (Package name: `at`)'

Description: The atd daemon must be running

Check Prereq Commands:

systemctl status atd || service atd status 

Get Prereq Commands:

echo 'Please start the `atd` daemon (sysv: `service atd start` ; systemd: `systemctl start atd`)'