Identifier / Programs / Windows

at.exe

Schedules commands and programs to run on a computer at a specified time and date. Windows commands reference

LOLBAS Execute 2 Sigma rules name it 1 ATT&CK technique 1 documented command 12 known copies with hashes

How at.exe is abused

documented by LOLBAS

Execute T1053.002 Scheduled Task/Job: At

-interactive

-every

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for at.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1053.002 Scheduled Task/Job: At Local Admin privileges

Create a recurring task to execute every day at a specific time.

C:\Windows\System32\at.exe 09:00 /interactive /every:m,t,w,th,f,s,su {CMD}

Identify

Trips 1 Sigma rule: highInteractive AT Job by E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for at.exe, by Freddie Barr-Smith, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for at.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highInteractive AT JobE.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community

highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)

T1053.002Scheduled Task/Job: At

Is it the real at.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionSchedule service command line interface

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\at.exe · signed by Microsoft Windows

d2d66e4c5a8ad6e01119eda5d6a107cea4ccfd2651448660d080b8977cb891ed

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\at.exe · signed by Microsoft Windows

efe060e64dd745c7e34c0fbd6d5a23e6db8dedea58979ee20754fd7d8f3c449f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\at.exe · signed by Microsoft Windows

5b97c39d87ad627c53023bfebb0ea1b5227c3f4e86e3bf06b23f3e4b0d6726e2

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\at.exe · signed by Microsoft Windows

c27460533b663278c2c03cd85384aa2560bc4a8ffa6d7160b070f8be62839145

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\at.exe · signed by Microsoft Windows

3375d519fb68bc608ab444d5a367df55f3b2353af9be3e88462f08006fb846bc

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\at.exe · signed by Microsoft Windows

7ea14e4186ad9771f5572cf364d1801521551b2c482c5e9945d56a54093bb773

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\at.exe · signed by Microsoft Windows

26dda3026e983ca98575339a0c8ffb5700dd9fb03693e92d5f192489b3f44067

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\at.exe · signed by Microsoft Windows

73a9a6a4c9cf19fcd117eb3c430e1c9acaded31b42875ba4f02fa61da1b8a6dc

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\at.exe · signed by Microsoft Windows

3616779903b0c2339744c3c69c264a0b69772b5b8cdaddc64fd1aafb8321afba

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\at.exe · signed by Microsoft Windows

a60d4e00e9df07ac09c8c607239db08bb7d167299572e4436a5b14cc2bf2ad26

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\at.exe · not signed

30f9d677e81dd561ebe084ad3d0c71f20711dfb99584af68e2b4ee2c495cbf9b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\at.exe · not signed

488e74e2026d03f21b33f470c23b3de2f466643186c2e06ae7b4883cc2e59377

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

Everyday use

from tldr-pages, CC BY 4.0

Create commands interactively and execute them in 5 minutes (press <Ctrl d> when done)

at now + 5 minutesIdentify

Create commands interactively and execute them at a specific time

at hh:mmIdentify

Execute a command from stdin at 10:00 AM today

echo "command" | at 1000Identify

None of the 3 examples the identifier reads matches LOLBAS abuse or trips a Sigma process-creation rule.

Options

3 in Windows commands reference

Show every option of at.exe

/deleteCancels a scheduled command.

/yesAnswers yes to all queries from the system when you delete scheduled events.

/?Displays help at the command prompt.