| splunk |
Linux At Application Execution |
production |
2026-10-09 |
| elastic |
Modification of Persistence Relevant Files Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Scheduled Tasks AT Command Enabled |
production |
2026-09-18 |
| elastic |
At Job Created or Modified |
production |
2026-09-18 |
| elastic |
Pod or Container Creation with Suspicious Command-Line |
production |
2026-09-18 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| splunk |
Linux Auditd At Application Execution |
production |
2026-05-13 |
| splunk |
Linux Possible Append Command To At Allow Config File |
production |
2026-05-13 |
| splunk |
Scheduled Task Creation on Remote Endpoint using At |
production |
2026-05-13 |
| sigma |
Remote Task Creation via ATSVC Named Pipe |
test |
2024-08-01 |
| sigma |
Remote Task Creation via ATSVC Named Pipe - Zeek |
test |
2022-12-27 |
| sigma |
Scheduled Task/Job At |
stable |
2022-07-07 |
| sigma |
Remote Schedule Task Lateral Movement via SASec |
test |
2022-01-01 |
| sigma |
Remote Schedule Task Lateral Movement via ITaskSchedulerService |
test |
2022-01-01 |
| sigma |
Remote Schedule Task Lateral Movement via ATSvc |
test |
2022-01-01 |
| sigma |
Interactive AT Job |
test |
2021-11-27 |
| sigma |
MITRE BZAR Indicators for Execution |
test |
2021-11-27 |