Detect job scheduling through the legacy at utility

Siemphony@siemphonymediumT1053.002verified in lab

MITRE's Windows analytic names two routes to the legacy job queue — running at.exe and driving the Win32_ScheduledJob WMI class — so the rule carries one selection for each: the image path for the binary, and two command-line forms of the class, the literal name as PowerShell and wmic path spell it plus the job call create form, because job is wmic's alias for Win32_ScheduledJob and that invocation never contains the class name. at.exe was deprecated in favour of schtasks more than a decade ago, which is what gives a bare execution event its value here; no command-line pattern is required, because on a modern estate the invocation itself is the anomaly and MITRE's CommandLinePattern knob is better used to rank matches than to gate them. Note that the WMI leg only sees the class named on a command line, so a compiled agent or implant calling Win32_ScheduledJob in-process is invisible to it, and the follow-on execution the analytic describes — an anomalous child of svchost.exe or taskeng.exe minutes later — is a timed correlation Sigma cannot express, so this rule is the scheduling step only. The logic is written in the Sysmon EventID 1 process_creation vocabulary; the strategy's other feed, Security 4698, needs the Audit Other Object Access Events subcategory enabled and carries the job definition in TaskContent rather than Image or CommandLine, so it cannot feed this rule without a field mapping first. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0333, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (FolderPath endswith "\\at.exe" or (ProcessCommandLine contains "Win32_ScheduledJob" or ProcessCommandLine contains " job call create"))

Splunk · SPL

Run this as a search.

index=* (Image="*\\at.exe" OR (CommandLine="*Win32_ScheduledJob*" OR CommandLine="* job call create*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.executable) LIKE "*\\\\at.exe" OR (TO_LOWER(process.command_line) LIKE "*win32_scheduledjob*" OR TO_LOWER(process.command_line) LIKE "* job call create*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\at\.exe$</field>    <description>Detect job scheduling through the legacy at utility (1/2)</description>    <mitre>      <id>T1053.002</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Win32_ScheduledJob| job call create)</field>    <description>Detect job scheduling through the legacy at utility (2/2)</description>    <mitre>      <id>T1053.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: persistence_scheduled_task
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: e0ef56ca-da0b-4599-858e-8ac73495d6d2

ATT&CKT1053.002

T1053.002At

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonpersistence scheduled task

persistence scheduled taskAI draft — unreviewed

01 · What this rule detects

The rule is Detect job scheduling through the legacy at utility, built from MITRE's Windows analytic AN0943. That analytic names two routes to the legacy job queue — running at.exe, and driving the Win32_ScheduledJob WMI class — and the rule carries one selection for each. It stops at the scheduling step. The second half of AN0943, an anomalous process spawned by svchost.exe or taskeng.exe minutes later, is a timed correlation Sigma cannot express, so it is not here. Note also that a hit evidences the invocation, not a created job: on current builds at.exe often prints its deprecation notice and schedules nothing.

02 · Telemetry you need

category: process_creation, product: windows, taken verbatim from the brief, and written in the Sysmon EventID 1 vocabulary — Image and CommandLine. The strategy's other feed, Security 4698, is a different shape: it needs the Audit Other Object Access Events subcategory turned on, which is off by default, and it carries the job definition in TaskContent rather than in Image or CommandLine. It cannot feed this rule without a field mapping first, so do not go configure that auditing expecting these selections to start matching.

03 · How the logic works

Two blocks, condition 1 of selection_*, so either fires alone. selection_binary is Image|endswith: '\at.exe' — no command-line pattern at all. That is deliberate: at was deprecated in favour of schtasks more than a decade ago, so on a modern estate the bare execution is itself the anomaly. selection_wmi is a two-term CommandLine|contains list: the literal Win32_ScheduledJob, which is how PowerShell and the wmic path form spell it, plus ' job call create'. The second term exists because job is wmic's alias for that class, so the documented adversary form — wmic /node:HOST job call create Command="cmd.exe /c ..." — contains no occurrence of the class name and the one-term version could not match it. The WMI leg only sees the class named on a command line; a compiled implant calling Win32_ScheduledJob in-process is invisible to it.

04 · Common false positives

Legacy in-house scripts and old third-party agents — backup, point-of-sale, imaging, industrial software written for XP or Server 2003 — still schedule their own work with at. Where one exists it runs on a schedule, so it re-alerts on the same host and account indefinitely until allow-listed. Second: at typed at an elevated prompt with no arguments only prints the queue, but produces a process-creation event indistinguishable from one that schedules a job. Third: audit and inventory scanners that enumerate the legacy queue during a sweep match the WMI half on every host in scope. That third entry and the rule's level: medium are in tension — a per-host-per-scan match is a volume claim, and if it holds in your estate the level belongs at low.

05 · Detection maturity

tier_1: Lowest tier. This rule has never been executed against a log line — the false-positive ordering and the level are argued, not measured — and it stays at the lowest tier until real data confirms both.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

AN0943's knobs are TaskUser, ExecutionTimeWindow and CommandLinePattern. TaskUser is the highest-value one: a non-admin or service account creating a job is far more interesting than an administrator doing it. CommandLinePattern is used here to rank rather than to gate — the rule fires without it — so scoring cmd.exe /c and PowerShell payloads higher is your job downstream. ExecutionTimeWindow needs correlation and cannot live in this file. The allow-list of legacy agents you build from the first false positive is the pipeline's suggestion, not MITRE's, and it is where most of the volume goes.

Declared by the author

Legacy in-house scripts and old third-party agents — backup, point-of-sale, imaging and industrial software written for XP or Server 2003 — that still schedule their own work with at rather than schtasks. Where one exists it runs on a schedule, so it re-alerts on the same host and account indefinitely until allow-listed.
Administrator and helpdesk habit: at typed at an elevated prompt to list or clear the legacy queue. Running it with no arguments only prints the queue, but produces a process-creation event indistinguishable from one that schedules a job.
Audit, inventory and compliance scanners that enumerate the legacy job queue by shelling out to at.exe or by querying Win32_ScheduledJob through wmic or PowerShell during a sweep — these match the WMI half of the rule on every host in scope, on every scan.
Adversary-simulation and control-validation tooling such as Atomic Red Team, whose T1053.002 tests invoke at.exe exactly as the rule expects.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — Scheduled task via at.exe
passed
Siemphony IR · 3 Sept 2026
2 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1053.002, evaluated against their process_creation events.

Share this rule

/u/siemphony/e0ef56ca-da0b-4599-858e-8ac73495d6d2

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect job scheduling through the legacy at utility

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it