Remotely Scheduled Tasks via AT
Hypothesis and description
When AT.exe is used to remotely schedule tasks, Windows uses named pipes over SMB to communicate with the API on the remote machine. After authentication over SMB, the Named Pipe "ATSVC" is opened, over which the JobAdd function is called. On the remote host, the job files are created by the Task Scheduler and follow the convention C:\Windows\System32\AT<job\_id>. Unlike CAR-2013-05-004, this analytic specifically focuses on uses of AT that can be detected between hosts, indicating remotely gained execution.
This pipe activity could be discovered with a network decoder, such as that in wireshark, that can inspect SMB traffic to identify the use of pipes. It could also be detected by looking for raw packet capture streams or from a custom sensor on the host that hooks the appropriate API functions. If no network or API level of visibility is possible, this traffic may inferred by looking at SMB connections over 445/tcp followed by the creation of files matching the pattern C:\Windows\System32\AT\<job_id\>.
- Platforms
- Windows
- Domain
- Host, Network
- Subtypes
- File API, PCAP
- Submitted
- 2015-04-29
- Contributors
- MITRE
ATT&CK coverage
| Technique | Tactics | Coverage |
|---|---|---|
| T1053 Scheduled Task/JobT1053.002 | Execution | Moderate |
1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
D3FEND techniques MITRE maps to this analytic
Data model references
Fields from the CAR data model (object/action/field) the analytic reads.
Pseudocode and implementations
To detect AT via network traffic, a sensor is needed that has the ability to extract and decode PCAP information. Specifically, it needs to properly decode SMB and the functions that are implemented over it via NamedPipes. If a sensor meets these criteria, then the PCAP data needs to search for instances of the command JobAdd over the pipe ATSVC, which is all implemented over Windows SMB 445/tcp.
flows = search Flow:Message
at_proto = filter flows where (dest_port == 445 and proto_info.pipe == "ATSVC")
at_create = filter flows where (proto_info.function == "JobAdd")
output at_createAcross MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-SJAScheduled Job Analysis1 shared
- D3-SDMSystem Daemon Monitoring1 shared
- D3-ABPIApplication-based Process Isolation1 shared
- D3-HRHost Reboot1 shared
- D3-HSHost Shutdown1 shared
- D3-KBPIKernel-based Process Isolation1 shared
- D3-PLAProcess Lineage Analysis1 shared
- D3-PSMDProcess Self-Modification Detection1 shared
- D3-PSProcess Suspension1 shared
- D3-PTProcess Termination1 shared
- D3-HBPIHardware-based Process Isolation1 shared
- D3-PSAProcess Spawn Analysis1 shared